The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3075-1 advisory.

    This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.55 fixes various security issues

    The following security issues were fixed:

    - CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
    - CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
    - CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
    - CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
    - CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
    - CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
    - CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
    - CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
    - CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-34911 advisory.

    - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
    - futex/requeue: Revert 'Prevent NULL pointer dereference in remove_waiter() on self-deadlock'' (CKI     Backport Bot) [RHEL-193250] {CVE-2026-53166}
    - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot)     [RHEL-193250] {CVE-2026-43499}
    - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153]     {CVE-2026-43499}
    - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153]     {CVE-2026-43499}
    - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}
    - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407]     {CVE-2026-53359}
    - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698]     {CVE-2026-46113}
    - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport     Bot) [RHEL-183007] {CVE-2025-71066}
    - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot)     [RHEL-179854] {CVE-2026-46227}
    - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
    - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
    - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048]     {CVE-2026-46155}
    - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot)     [RHEL-181902] {CVE-2026-46259}
    - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786]     {CVE-2026-43341}
    - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277]     {CVE-2026-43276}
    - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277]     {CVE-2026-43276}
    - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491]     {CVE-2026-43112}
    - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
    - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592]     {CVE-2025-10263}
    - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
    - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
    - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
    - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
    - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot)     [RHEL-183965] {CVE-2026-46316}
    - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
    - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot)     [RHEL-179912] {CVE-2026-46209}
    - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566]     {CVE-2026-45998}
    - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}
    - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001]     {CVE-2026-46176}
    - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}
    - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965]     {CVE-2026-46189}
    - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317]     {CVE-2026-46090}
    - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937]     {CVE-2026-43279}
    - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}
    - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}
    - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155]     {CVE-2026-46117}
    - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665]     {CVE-2026-45898}
    - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}
    - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106]     {CVE-2026-46135}
    - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}
    - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675]     {CVE-2026-43038}
    - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380]     {CVE-2026-46331}
    - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}
    - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:34911 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)

    * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998)

    * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()     (CVE-2026-46209)

    * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)

    * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception     level resources (CVE-2025-10263)

    * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry     (CVE-2026-46316)

    * kernel: kernel: ipv6 frag escape ()

    Bug Fix(es) and Enhancement(s):

    * crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [rhel-10.2.z]     (JIRA:RHEL-182537)

    * [ThinkPad Avon/Mario +RHEL 10.2]The OS hang up with CapsLock fliker (JIRA:RHEL-185110)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:34911 advisory.

    * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)
      * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998)
      * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()     (CVE-2026-46209)
      * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)
      * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception     level resources (CVE-2025-10263)
      * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry     (CVE-2026-46316)
      * kernel: kernel: ipv6 frag escape ()


    Bug Fix(es) and Enhancement(s):

      * crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [almalinux-10.2.z]     (JIRA:AlmaLinux-182537)
      * [ThinkPad Avon/Mario +AlmaLinux 10.2]The OS hang up with CapsLock fliker (JIRA:AlmaLinux-185110)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2930-1 advisory.

    This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.3 fixes various security issues

    The following security issues were fixed:

    - CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256615).
    - CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
    - CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
    - CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
    - CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263118).
    - CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
    - CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
    - CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264094).
    - CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
    - CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
    - CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
    - CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
    - CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
    - CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
    - CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265127).
    - CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
    - CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
    - CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
    - CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
    - CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
    - CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
    - CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
    - CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
    - CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
    - CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2956-1 advisory.

    This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.37 fixes various security issues

    The following security issues were fixed:

    - CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
    - CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
    - CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
    - CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263118).
    - CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
    - CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
    - CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
    - CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
    - CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
    - CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
    - CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
    - CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
    - CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
    - CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
    - CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
    - CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
    - CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
    - CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
    - CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
    - CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
    - CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
    - CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0792 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-31502:
    In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping     after cycling ILOCK. xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork     mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction,     which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow     fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping     beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the     wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio     write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence     counter changes across the ILOCK cycle.

    CVE-2026-53362:
    In the Linux kernel, the following vulnerability has been resolved:

    eventpoll: fix ep_remove struct eventpoll / struct file UAF

    ep_remove() (via ep_remove_file()) cleared file->f_ep under     file->f_lock but then kept using @file inside the critical section     (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock).
    A concurrent __fput() taking the eventpoll_release() fastpath in     that window observed the transient NULL, skipped     eventpoll_release_file() and ran to f_op->release / file_free().

    For the epoll-watches-epoll case, f_op->release is     ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which     kfree()s the watched struct eventpoll. Its embedded ->refs     hlist_head is exactly where epi->fllink.pprev points, so the     subsequent hlist_del_rcu()'s *pprev = next scribbles into freed     kmalloc-192 memory.

    In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot     backing @file could be recycled by alloc_empty_file() --     reinitializing f_lock and f_ep -- while ep_remove() is still     nominally inside that lock. The upshot is an attacker-controllable     kmem_cache_free() against the wrong slab cache.

    Pin @file via epi_fget() at the top of ep_remove() and gate the     critical section on the pin succeeding. With the pin held @file     cannot reach refcount zero, which holds __fput() off and     transitively keeps the watched struct eventpoll alive across the     hlist_del_rcu() and the f_lock use, closing both UAFs.

    If the pin fails @file has already reached refcount zero and its
    __fput() is in flight. Because we bailed before clearing f_ep,     that path takes the eventpoll_release() slow path into     eventpoll_release_file() and blocks on ep->mtx until the waiter     side's ep_clear_and_put() drops it. The bailed epi's share of     ep->refcount stays intact, so the trailing ep_refcount_dec_and_test()     in ep_clear_and_put() cannot free the eventpoll out from under     eventpoll_release_file(); the orphaned epi is then cleaned up     there.

    A successful pin also proves we are not racing     eventpoll_release_file() on this epi, so drop the now-redundant     re-check of epi->dying under f_lock. The cheap lockless     READ_ONCE(epi->dying) fast-path bailout stays.

    CVE-2026-43456:
    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: account for fraggap on the paged allocation path

    In __ip6_append_data(), when the paged-allocation branch is taken     (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are     computed as

            alloclen = fragheaderlen + transhdrlen;
            pagedlen = datalen - transhdrlen;

    datalen already includes fraggap (datalen = length + fraggap). When     fraggap is non-zero, this is not the first skb and transhdrlen is zero.
    The fraggap bytes carried over from the previous skb are copied just past     the fragment headers in the new skb's linear area. The linear area is     therefore undersized by fraggap bytes while pagedlen is overstated by the     same amount, and the copy writes past skb->end into the trailing     skb_shared_info.

    An unprivileged user can trigger this via a UDPv6 socket using     MSG_MORE together with MSG_SPLICE_PAGES.

    The bad accounting was introduced by commit 773ba4fe9104 (ipv6:
    avoid partial copy for zc). Before commit ce650a166335 (udp6: Fix
    __ip6_append_data()'s handling of MSG_SPLICE_PAGES), the negative     copy value caused -EINVAL to be returned. That later commit allowed     MSG_SPLICE_PAGES to proceed in this case, making the corruption     triggerable.

    The non-paged branch sets alloclen to fraglen, which already accounts     for fraggap because datalen does. Bring the paged branch in line by     adding fraggap to alloclen and subtracting it from pagedlen.

    After this adjustment, copy no longer collapses to -fraggap on the     paged path, so remove the stale comment describing that old arithmetic.
    Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES     case, remove the MSG_SPLICE_PAGES exception from the negative copy check.

    CVE-2026-46242:
    In the Linux kernel, the following vulnerability has been resolved:

    bonding: fix type confusion in bond_setup_by_slave()

    kernel BUG at net/core/skbuff.c:2306!     Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI     RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306     RSP: 0018:ffffc90004aff760 EFLAGS: 00010293     RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e     RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900     RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000     R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780     R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0     Call Trace:
     <TASK>      ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900      dev_hard_header include/linux/netdevice.h:3439 [inline]      packet_snd net/packet/af_packet.c:3028 [inline]      packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108      sock_sendmsg_nosec net/socket.c:727 [inline]
     __sock_sendmsg net/socket.c:742 [inline]
     ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592
     ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646
     __sys_sendmsg+0x170/0x220 net/socket.c:2678      do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]      do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94      entry_SYSCALL_64_after_hwframe+0x77/0x7f     RIP: 0033:0x7fe1a0e6c1a9

    When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,     bond_setup_by_slave() directly copies the slave's header_ops to the     bond device:

      bond_dev->header_ops = slave_dev->header_ops;

    This causes a type confusion when dev_hard_header() is later called     on the bond device. Functions like ipgre_header(), ip6gre_header(),all use     netdev_priv(dev) to access their device-specific private data. When     called with the bond device, netdev_priv() returns the bond's private     data (struct bonding) instead of the expected type (e.g. struct     ip_tunnel), leading to garbage values being read and kernel crashes.

    Fix this by introducing bond_header_ops with wrapper functions that     delegate to the active slave's header_ops using the slave's own     device. This ensures netdev_priv() in the slave's header functions     always receives the correct device.

    The fix is placed in the bonding driver rather than individual device     drivers, as the root cause is bond blindly inheriting header_ops from     the slave without considering that these callbacks expect a specific     netdev_priv() layout.

    The type confusion can be observed by adding a printk in     ipgre_header() and running the following commands:

      ip link add dummy0 type dummy       ip addr add 10.0.0.1/24 dev dummy0       ip link set dummy0 up       ip link add gre1 type gre local 10.0.0.1       ip link add bond1 type bond mode active-backup       ip link set gre1 master bond1       ip link set gre1 up       ip link set bond1 up       ip addr add fe80::1/64 dev bond1

    CVE-2026-23451:
    In the Linux kernel, the following vulnerability has been resolved:

    team: fix header_ops type confusion with non-Ethernet ports

    Similar to commit 950803f72547 (bonding: fix type confusion in     bond_setup_by_slave()) team has the same class of header_ops type     confusion.

    For non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops     directly. When the team device later calls dev_hard_header() or     dev_parse_header(), these callbacks can run with the team net_device     instead of the real lower device, so netdev_priv(dev) is interpreted as     the wrong private type and can crash.

    The syzbot report shows a crash in bond_header_create(), but the root     cause is in team: the topology is gre -> bond -> team, and team calls     the inherited header_ops with its own net_device instead of the lower     device, so bond_header_create() receives a team device and interprets     netdev_priv() as bonding private data, causing a type confusion crash.

    Fix this by introducing team header_ops wrappers for create/parse,     selecting a team port under RCU, and calling the lower device callbacks     with port->dev, so each callback always sees the correct net_device     context.

    Also pass the selected lower device to the lower parse callback, so     recursion is bounded in stacked non-Ethernet topologies and parse     callbacks always run with the correct device context.

    CVE-2026-64600:
    In the Linux kernel, the following vulnerability has been resolved:

    bonding: prevent potential infinite loop in bond_header_parse()

    bond_header_parse() can loop if a stack of two bonding devices is setup,     because skb->dev always points to the hierarchy top.

    Add new const struct net_device *dev parameter to     (struct header_ops)->parse() method to make sure the recursion     is bounded, and that the final leaf parse method is called.

    CVE-2026-64531:
    In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized     nested action attrs. Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. An     oversized generated container can be closed with a truncated nla_len, causing later dump or teardown to     walk a structurally different stream than the one that was validated. An oversized nested CLONE/CT action     may cause subsequent bytes to be interpreted as independent actions.

    CVE-2026-64564:
    In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own     transport in DEL-IP processing. sctp_process_asconf() caches the transport the ASCONF chunk is processed     against in asconf->transport. For an ASCONF located through its Address Parameter, that cached transport     corresponds to the Address Parameter, which need not be the packet's source address. A single ASCONF can     carry DEL-IP for the cached transport followed by a wildcard DEL-IP, causing use-after-free of the freed     transport.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500150 advisory.

    - x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov (AMD))  [Orabug: 39844812]     {CVE-2026-68480}
    - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Sean Christopherson)     [Orabug: 39844799]  {CVE-2026-64561}
    - net: openvswitch: reject oversized nested action attrs (Asim Viladi Oglu Manizada)  [Orabug: 39816011]     {CVE-2026-64531}
    - xfrm: hold dev ref until after transport_finish NF_HOOK (Qi Tang)  [Orabug: 39262397]  {CVE-2026-31663}
    - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (Hyunwoo Kim)     [Orabug: 39531622]  {CVE-2026-46316}
    - ipv6: account for fraggap on the paged allocation path (Wongi Lee)  [Orabug: 39686467]  {CVE-2026-53362}
    - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [Orabug:
    39673856,39686459] {CVE-2026-53359}
    - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta) [Orabug:
    39567285,39668752] {CVE-2026-46331}
    - net_sched: act_pedit: use RCU in tcf_pedit_dump() (Eric Dumazet) [Orabug: 39567285] {CVE-2026-46331}
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner) [Orabug: 39466882]     {CVE-2026-46242}
    - eventpoll: move epi_fget() up (Christian Brauner) [Orabug: 39466882] {CVE-2026-46242}
    - eventpoll: rename ep_remove_safe() back to ep_remove() (Christian Brauner) [Orabug: 39466882]     {CVE-2026-46242}
    - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Christian Brauner) [Orabug: 39466882]     {CVE-2026-46242}
    - eventpoll: kill __ep_remove() (Christian Brauner) [Orabug: 39466882] {CVE-2026-46242}
    - eventpoll: split __ep_remove() (Christian Brauner) [Orabug: 39466882] {CVE-2026-46242}
    - eventpoll: use hlist_is_singular_node() in __ep_remove() (Christian Brauner) [Orabug: 39466882]     {CVE-2026-46242}
    - md: fix array_state=clear sysfs deadlock (Yu Kuai) [Orabug: 39190489,39668924] {CVE-2026-53125}
    - md: avoid repeated calls to del_gendisk (Xiao Ni) [Orabug: 39190489,39668918] {CVE-2025-68373}
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen) [Orabug:
    39619387,39639984,39656679] {CVE-2026-52943}
    - net/mlx5: Fix crash when moving to switchdev mode (Patrisious Haddad) [Orabug: 38667152,39344020]     {CVE-2026-43467}
    - net/mlx5: Fix double unregister of HCA_PORTS component (Gerd Bayer) [Orabug: 38667152,39590860]     {CVE-2025-68790}
    - net/mlx5: Fix IPsec cleanup over MPV device (Patrisious Haddad) [Orabug: 38667152,38730559]     {CVE-2025-40238}
    - net/mlx5: HWS, fix complex rules rehash error flow (Yevgeny Kliteynik) [Orabug: 38667152,39590850]     {CVE-2025-39768}
    - macsec: sync features on RTM_NEWLINK (Stanislav Fomichev) [Orabug: 38667152,39590858] {CVE-2025-39874}
    - net: dev_ioctl: take ops lock in hwtstamp lower paths (Carolina Jubran) [Orabug: 38667152,39590854]     {CVE-2025-39908}
    - team: replace team lock with rtnl lock (Stanislav Fomichev) [Orabug: 38667152,39590857] {CVE-2025-39733}
    - net: prevent a NULL deref in rtnl_create_link() (Eric Dumazet) [Orabug: 38667152,39590851]     {CVE-2025-38271}
    - virtio-pci: Fix result size returned for the admin command completion (Israel Rukshin) [Orabug:
    38667152,39590859] {CVE-2025-38314}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
327588	SUSE SLES15 Security Update : kernel (Live Patch 15 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3075-1)	Nessus	SuSE Local Security Checks	2026/7/17	2026/9/2	high
329149	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3166-1)	Nessus	SuSE Local Security Checks	2026/7/23	2026/9/2	medium
334525	Oracle Linux 10 : kernel (ELSA-2026-34911)	Nessus	Oracle Linux Local Security Checks	2026/8/11	2026/9/2	high
324922	RHEL 10 : kernel (RHSA-2026:34911)	Nessus	Red Hat Local Security Checks	2026/7/2	2026/9/2	high
325272	AlmaLinux 10 : kernel (ALSA-2026:34911)	Nessus	Alma Linux Local Security Checks	2026/7/6	2026/9/2	high
326930	SUSE SLES15 Security Update : kernel (Live Patch 1 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:2930-1)	Nessus	SuSE Local Security Checks	2026/7/15	2026/9/2	high
326944	SUSE SLES15 Security Update : kernel (Live Patch 11 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:2956-1)	Nessus	SuSE Local Security Checks	2026/7/15	2026/9/2	high
333128	TencentOS Server 4: kernel (TSSA-2026:0792)	Nessus	Tencent Local Security Checks	2026/8/6	2026/9/2	critical
334160	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500150)	Nessus	Oracle Linux Local Security Checks	2026/8/10	2026/9/2	medium

检测

插件搜索

high

medium

high

high

high

high

high

critical

medium