The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-83157 advisory.

    - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278122] {CVE-2026-93262}
    - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275085] {CVE-2026-93228}
    - svcrdma: Address an integer overflow (Olga Kornievskaia) [RHEL-275085] {CVE-2024-53151}
    - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270899]     {CVE-2026-90036}
    - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271446]     {CVE-2026-89526}
    - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268111] {CVE-2026-74705}
    - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261680]     {CVE-2026-72262}
    - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256443] {CVE-2026-74641}
    - net/sched: cls_route: fix fastmap use-after-free on filter (CKI Backport Bot) [RHEL-248781]     {CVE-2026-74583}
    - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240916]     {CVE-2026-68377}
    - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (Jocelyn Falempe) [RHEL-262108]     {CVE-2026-89811}
    - drm/amd/display: set new_stream to NULL after release (Jocelyn Falempe) [RHEL-260521] {CVE-2026-68236}
    - drm/vmwgfx: use check_add_overflow for shader size+offset bound (Jocelyn Falempe) [RHEL-258131]     {CVE-2026-80887}
    - drm/amdgpu/vce: fix integer overflow in image size (Jocelyn Falempe) [RHEL-237823 RHEL-268877]     {CVE-2026-68108}
    - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (Jocelyn Falempe) [RHEL-240862]     {CVE-2026-68278}
    - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225371]     {CVE-2026-63920}
    - wifi: mac80211: defer link RX stats percpu free to RCU (CKI Backport Bot) [RHEL-263760] {CVE-2026-68409}
    - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261990] {CVE-2026-72318}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (Timothy Redaelli) [RHEL-253844]     {CVE-2026-31678}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:83207 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859)

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)

    * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)

    * kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)

    * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)

    * kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974)

    * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)

    * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)

    * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)

    * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)

    * kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574)

    * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

    * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)

    * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)

    * kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)

    * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

    * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

    * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)

    * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

    Bug Fix(es) and Enhancement(s):

    * cannot use VFs of i40e/ice NIC in bond device (JIRA:RHEL-143410)

    * ionic: commit backported to 9.8 missing in 10.2 (JIRA:RHEL-165657)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-83207 advisory.

    - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473]     {CVE-2026-80985}
    - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473]     {CVE-2026-80985}
    - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473]     {CVE-2026-80985}
    - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057]     {CVE-2026-93207}
    - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228}
    - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689}
    - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946]     {CVE-2026-90036}
    - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946]     {CVE-2026-89659}
    - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459]     {CVE-2026-89526}
    - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501]     {CVE-2026-89894}
    - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677]     {CVE-2026-72262}
    - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140}
    - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554]     {CVE-2026-64030}
    - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316]     {CVE-2026-63956}
    - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316]     {CVE-2026-63957}
    - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316]     {CVE-2026-63928}
    - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316]     {CVE-2026-63899}
    - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721]     {CVE-2026-45859}
    - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641}
    - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620]     {CVE-2026-74574}
    - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402]     {CVE-2026-68291}
    - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402]     {CVE-2026-53286}
    - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402]     {CVE-2026-64162}
    - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402]     {CVE-2026-31647}
    - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763]     {CVE-2026-63974}
    - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763]     {CVE-2026-63974}
    - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917]     {CVE-2026-68377}
    - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot)     [RHEL-232531] {CVE-2026-64032}
    - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655]     {CVE-2026-46319}
    - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot)     [RHEL-226492] {CVE-2026-53011}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:83156 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)

    * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)

    * kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404)

    * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)

    * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling     (CVE-2026-72288)

    * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)

    * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)

    * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

    * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)

    * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)

    * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)

    * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)

    * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

    * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)

    * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:83156 advisory.

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
      * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)
      * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)
      * kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404)
      * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
      * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
      * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
      * kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling     (CVE-2026-72288)
      * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
      * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)
      * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
      * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
      * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)
      * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
      * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)
      * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
      * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)
      * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1794643812 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz     capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every     band if 6 GHz is supported, so add the size to scan_ies_len. Otherwise, building probe request elements     can fail, triggering the WARN_ON in __ieee80211_start_scan(). (CVE-2026-98328)

  - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix issue in verifying     allow_ptr_leaks After we converted the capabilities of our networking-bpf program from cap_sys_admin to     cap_net_admin+cap_bpf, our networking-bpf program failed to start. Because it failed the bpf verifier, and     the error log is R3 pointer comparison prohibited. A simple reproducer as follows, SEC(cls-ingress)     int ingress(struct __sk_buff *skb) { struct iphdr *iph = (void *)(long)skb->data + sizeof(struct ethhdr);
    if ((long)(iph + 1) > (long)skb->data_end) return TC_ACT_STOLEN; return TC_ACT_OK; } Per discussion with     Yonghong and Alexei [1], comparison of two packet pointers is not a pointer leak. This patch fixes it. Our     local kernel is 6.1.y and we expect this fix to be backported to 6.1.y, so stable is CCed. [1].
    https://lore.kernel.org/bpf/CAADnVQ+Nmspr7Si+pxWn8zkE7hX-7s93ugwC+94aXSy4uQ9vBg@mail.gmail.com/     (CVE-2023-54181)

  - In the Linux kernel, the following vulnerability has been resolved: driver core: Avoid warning when     removing a device while its supplier is unbinding During driver removal, the following warning can appear:
    WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 __device_links_no_driver+0xcc/0xfc ... Call trace:
    __device_links_no_driver+0xcc/0xfc (P) device_links_driver_cleanup+0xa8/0xf0     device_release_driver_internal+0x208/0x23c device_links_unbind_consumers+0xe0/0x108     device_release_driver_internal+0xec/0x23c device_links_unbind_consumers+0xe0/0x108     device_release_driver_internal+0xec/0x23c device_links_unbind_consumers+0xe0/0x108     device_release_driver_internal+0xec/0x23c driver_detach+0xa0/0x12c bus_remove_driver+0x6c/0xbc     driver_unregister+0x30/0x60 pci_unregister_driver+0x20/0x9c lan966x_pci_driver_exit+0x18/0xa90     [lan966x_pci] This warning is triggered when a consumer is removed because the links status of its     supplier is not DL_DEV_DRIVER_BOUND and the link flag DL_FLAG_SYNC_STATE_ONLY is not set. The topology in     terms of consumers/suppliers used was the following (consumer ---> supplier): i2c -----------> OIC ---->     PCI device | ^ | | +---> pinctrl ---+ When the PCI device is removed, the OIC (interrupt controller) has     to be removed. In order to remove the OIC, pinctrl and i2c need to be removed and to remove pinctrl, i2c     need to be removed. The removal order is: 1) i2c 2) pinctrl 3) OIC 4) PCI device In details, the removal     sequence is the following (with 0000:01:00.0 the PCI device): driver_detach: call     device_release_driver_internal(0000:01:00.0)... device_links_busy(0000:01:00.0): links->status =     DL_DEV_UNBINDING device_links_unbind_consumers(0000:01:00.0): 0000:01:00.0--oic link->status =     DL_STATE_SUPPLIER_UNBIND call device_release_driver_internal(oic)... device_links_busy(oic): links->status     = DL_DEV_UNBINDING device_links_unbind_consumers(oic): oic--pinctrl link->status =     DL_STATE_SUPPLIER_UNBIND call device_release_driver_internal(pinctrl)... device_links_busy(pinctrl):
    links->status = DL_DEV_UNBINDING device_links_unbind_consumers(pinctrl): pinctrl--i2c link->status =     DL_STATE_SUPPLIER_UNBIND call device_release_driver_internal(i2c)... device_links_busy(i2c): links->status     = DL_DEV_UNBINDING __device_links_no_driver(i2c)... pinctrl--i2c link->status is DL_STATE_SUPPLIER_UNBIND     oic--i2c link->status is DL_STATE_ACTIVE oic--i2c link->supplier->links.status is DL_DEV_UNBINDING The     warning is triggered by the i2c removal because the OIC (supplier) links status is not     DL_DEV_DRIVER_BOUND. Its links status is indeed set to DL_DEV_UNBINDING. It is perfectly legit to have the     links status set to DL_DEV_UNBINDING in that case. Indeed we had started to unbind the OIC which triggered     the consumer unbinding and didn't finish yet when the i2c is unbound. Avoid the warning when the supplier     links status is set to DL_DEV_UNBINDING and thus support this removal sequence without any warnings.
    (CVE-2026-97479)

  - In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB     altmode array index The UCSI displayport driver indexes the connector's port altmode array with the     GET_CURRENT_CAM response after checking it is not 0xff. The port altmode array is UCSI_MAX_ALTMODES     elements long. If the PPM returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and not     equal to 0xff, the kernel may crash with an array index OOB error. Update the UCSI displayport driver to     verify the current cam is less than UCSI_MAX_ALTMODES before accessing the port altmode array.
    (CVE-2026-90025)

  - In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: fix layout segment leak on     the pnfs_layout_process() forget path When the server returns a new layout stateid while a valid one is     still held, pnfs_layout_process() calls pnfs_mark_matching_lsegs_return() on the on-stack free_me list and     jumps to out_forget. Segments whose reference count drops to zero are unlinked from lo->plh_segs and moved     to free_me by mark_lseg_invalid(); for an idle cached segment the layout header holds the only reference,     so this happens on the first decrement. out_forget never drains free_me -- only the success path calls     pnfs_free_lseg_list(). Commit 814b84971388 (pNFS/NFSv4: Fix a layout segment leak in     pnfs_layout_process()) added the drain; commit 08bd8dbe8882 (pNFS/NFSv4: Try to return invalid layout in     pnfs_layout_process()) removed it while switching the destination to lo->plh_return_segs, which is     drained elsewhere. Commit fb700ef02676 (NFSv4.1: Simplify layout return in pnfs_layout_process())     switched the destination back to free_me without restoring the drain. Restore the pnfs_free_lseg_list()     call. (CVE-2026-89710)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3389 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    vhost: fix vhost_get_avail_idx for a non empty ring (CVE-2026-74356)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: validate cookie AUTH state before use (CVE-2026-74752)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Prevent client use-after-free during delegation revoke (CVE-2026-89659)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() (CVE-2026-97563)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Preserve inner map identity in callback frames (CVE-2026-98033)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix create context out-of-bounds reads (CVE-2026-98454)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN (CVE-2026-98715)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: prevent GCM nonce reuse on peer key changes (CVE-2026-98805)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: check RCV_SHUTDOWN after the sendmsg connect wait (CVE-2026-98846)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvs: bound LBLCR and LBLC cache growth (CVE-2026-98857)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: hold a reference to nodes found by link name (CVE-2026-99053)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Use active memslots for the per-vCPU MMIO cache (CVE-2026-99082)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:98608 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors (CVE-2024-57793)

    * kernel: OPP: add index check to assert to avoid buffer overflow in _read_freq() (CVE-2024-57998)

    * kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)

    * kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)

    * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)

    * kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076)

    * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176)

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)

    * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264)

    * kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)

    * kernel: vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365)

    * kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398)

    * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

    * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388)

    * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)

    * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962)

    * kernel: vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970)

    * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)

    * kernel: vfio/pci: Check BAR resources before exporting a DMABUF (CVE-2026-64042)

    * kernel: vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)

    * kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)

    * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)

    * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)

    * kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)

    * kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)

    * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)

    * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)

    * kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)

    * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)

    * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)

    * kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317)

    * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)

    * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509)

    * kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)

    * kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574)

    * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

    * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

    * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)

    * kernel: af_unix: Unlink scc_entry in unix_del_edge() (CVE-2026-80521)

    * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

    * kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

    * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

    * kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)

    * kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF (CVE-2026-89690)

    * kernel: nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669)

    * kernel: net: tun: bound receive headroom (CVE-2026-81000)

    * kernel: svcrdma: Reject inline replies that overflow the pull-up buffer (CVE-2026-89530)

    * kernel: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (CVE-2026-89676)

    * kernel: nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663)

    * kernel: nfsd: fix UAF in async copy cancel and shutdown (CVE-2026-89675)

    * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)

    * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    * kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)

    * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)

    * kernel: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (CVE-2026-89775)

    * kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)

    * kernel: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (CVE-2026-89791)

    * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

    * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

    * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)

    * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)

    * kernel: scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame (CVE-2026-90008)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

    * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

    * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

    * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)

    * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

    * kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

    * kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)

    * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)

    * kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation ()

    * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)

    * kernel: signal: Prevent exec() race (CVE-2026-98256)

    * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

    * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260)

    * kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320)

    * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

    * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

    * kernel: kernel: xfs: Unauthorized data modification via improper file size exchange handling     (CVE-2026-98974)

    * kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege     Escalation Vulnerability ()

    Bug Fix(es) and Enhancement(s):

    * [HPEMC RHEL 10.3 BUG] bnxt_en: Fix NULL pointer dereference (JIRA:RHEL-185083)

    * netfilter: rebase to 7.2 (JIRA:RHEL-242582)

    * [Intel 10.3 FEAT] idpf: Driver Update [rhel-10.3.z] (JIRA:RHEL-248077)

    * RHEL 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [rhel-10.3.z]     (JIRA:RHEL-254106)

    * cannot use VFs of i40e/ice NIC in bond device (JIRA:RHEL-276751)

    * [EC2][CVM]AMD SEV-SNP guest hangs during early boot on RHEL 10.3 and 10.4 (regression from 10.2)     [rhel-10.3.z] (JIRA:RHEL-283382)

    * backport fixes for lockdep issues reported with rt-debug [rhel-10.3.z] (JIRA:RHEL-259938)

    * [RHEL 10] fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal     [rhel-10.3.z] (JIRA:RHEL-284384)

    * RHEL is missing support for conntrack zone filtering in dump/delete requests (10.4) [rhel-10.3.z]     (JIRA:RHEL-291349)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-83156 advisory.

    - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472]     {CVE-2026-80985}
    - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472]     {CVE-2026-80985}
    - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472]     {CVE-2026-80985}
    - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa)     [RHEL-243814] {CVE-2026-72288}
    - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058]     {CVE-2026-93207}
    - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228}
    - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929]     {CVE-2026-90036}
    - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929]     {CVE-2026-89659}
    - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453]     {CVE-2026-89526}
    - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705}
    - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908]     {CVE-2026-81003}
    - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez)     [RHEL-240485] {CVE-2026-68404}
    - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez)     [RHEL-240485] {CVE-2026-68404}
    - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez)     [RHEL-240485] {CVE-2026-68404}
    - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788]     {CVE-2026-68409}
    - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560]     {CVE-2026-64030}
    - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686]     {CVE-2026-72262}
    - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140}
    - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot)     [RHEL-261293] {CVE-2026-72320}
    - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641}
    - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219]     {CVE-2026-68377}
    - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654]     {CVE-2026-46319}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_83156 advisory.

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)

    * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)

    * kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404)

    * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)

    * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)

    * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

    * kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling     (CVE-2026-72288)

    * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)

    * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)

    * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

    * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)

    * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)

    * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)

    * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)

    * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

    * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)

    * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining     reference a blocked lock on nn->blocked_locks_lru -- holds a raw pointer to its nfs4_client but no     reference keeping the client alive. When the per-net laundromat reaps such a lock, freeing the nbl drops     the owner reference held through flc_owner, and the final nfs4_put_stateowner() takes the client's     cl_lock. Because the laundromat detaches the nbl first, __destroy_client() no longer finds it, so a     concurrent force_expire_client() can free the client before nfs4_put_stateowner() runs, dereferencing     cl_lock in freed memory. Pin the client with cl_rpc_users before dropping nn->blocked_locks_lock, and skip     clients already expiring, whose blocked locks __destroy_client() frees while holding an owner reference.
    Take nn->client_lock outside nn->blocked_locks_lock. Every other site holds nn->blocked_locks_lock as a     leaf, acquiring no further lock, so placing nn->client_lock outside it cannot form a lock-order cycle.
    (CVE-2026-90036)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-9002-1 advisory.

    It was discovered that the io_uring subsystem in the Linux kernel did not properly handle canceled task     work when processing certain wait operations, leading to the operation being performed in the wrong task     context. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2026-81010)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM32 architecture;

    - ARM64 architecture;

    - MIPS architecture;

    - OpenRISC architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - x86 architecture;

    - Intel NPU Driver;

    - ACPI drivers;

    - Serial ATA and Parallel ATA drivers;

    - Auxiliary display drivers;

    - Ublk userspace block driver;

    - Bluetooth drivers;

    - Character device driver;

    - CPU idle management framework;

    - Hardware crypto device drivers;

    - CXL (Compute Express Link) drivers;

    - ARM SCMI message protocol;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - HSI subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - I3C subsystem;

    - IIO subsystem;

    - InfiniBand drivers;

    - Input Device core drivers;

    - On-Chip Interconnect management framework;

    - IOMMU subsystem;

    - Multiple devices driver;

    - Media drivers;

    - Fastrpc Driver;

    - Amazon Nitro Secure Module driver;

    - MMC subsystem;

    - MTD block device drivers;

    - Ethernet bonding driver;

    - Network drivers;

    - Microsoft Azure Network Adapter (MANA) driver;

    - Texas Instruments network drivers;

    - MediaTek network drivers;

    - NTB driver;

    - NVDIMM (Non-Volatile Memory Device) drivers;

    - NVME drivers;

    - NVMEM (Non Volatile Memory) drivers;

    - PCI subsystem;

    - Chrome hardware platform drivers;

    - x86 platform drivers;

    - Power supply drivers;

    - RapidIO drivers;

    - Voltage and Current Regulator drivers;

    - S/390 drivers;

    - SCSI subsystem;

    - SLIMbus drivers;

    - NVIDIA Tegra SoC drivers;

    - Realtek RTL8723BS SDIO drivers;

    - TCM subsystem;

    - Trusted Execution Environment drivers;

    - Thunderbolt and USB4 drivers;

    - TTY drivers;

    - USB Device Class drivers;

    - Faraday FOTG210 USB2 dual-role controller driver;

    - USB Gadget drivers;

    - USB Host Controller drivers;

    - Siemens ID Mouse USB driver;

    - IOWarrior USB driver;

    - LD Didactic USB driver;

    - LEGO USB Tower driver;

    - USB Serial drivers;

    - USB Type-C support driver;

    - USB Type-C Port Controller Manager driver;

    - USB Type-C Connector System Software Interface driver;

    - USB over IP driver;

    - VFIO drivers;

    - Framebuffer layer;

    - W1 Dallas's 1-wire bus driver;

    - AFS file system;

    - BTRFS file system;

    - Ceph distributed file system;

    - eCrypt file system;

    - File systems infrastructure;

    - Ext4 file system;

    - F2FS file system;

    - FUSE (File system in Userspace);

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - OCFS2 file system;

    - OrangeFS file system;

    - SMB network file system;

    - UBI file system;

    - Drivers core;

    - Tracing infrastructure;

    - KProbes tracing;

    - Networking core;

    - Netfilter;

    - Sun RPC protocol;

    - IPv6 networking;

    - Bluetooth subsystem;

    - IPv4 networking;

    - IP tunnels definitions;

    - SCTP protocol;

    - User-space API (UAPI);

    - IPC subsystem;

    - Audit subsystem;

    - BPF subsystem;

    - DMA mapping infrastructure;

    - Kernel futex primitives;

    - Scheduler infrastructure;

    - Signal handling mechanism;

    - Memory management;

    - 6LoWPAN network protocol;

    - IEEE 802 network protocols;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - CAN network layer;

    - Ceph Core library;

    - Devlink API;

    - HSR network protocol;

    - IEEE802154.4 network protocol;

    - IUCV driver;

    - MAC80211 subsystem;

    - Management Component Transport Protocol (MCTP);

    - MultiProtocol Label Switching driver;

    - Multipath TCP;

    - NetLabel subsystem;

    - Open vSwitch;

    - Packet sockets;

    - RDS protocol;

    - Network traffic control;

    - SMC sockets;

    - Network sockets;

    - VMware vSockets driver;

    - XFRM subsystem;

    - AppArmor security module;

    - Key management;

    - Landlock security;

    - Simplified Mandatory Access Control Kernel framework;

    - ALSA framework;

    - Digigram PCXHR ALSA driver;

    - Wolfson Microelectronics audio codecs;

    - USB sound devices;

    - KVM subsystem; (CVE-2024-40954, CVE-2025-38261, CVE-2025-68296, CVE-2025-68730, CVE-2025-68768,     CVE-2026-23346, CVE-2026-43219, CVE-2026-43240, CVE-2026-43311, CVE-2026-43331, CVE-2026-45930,     CVE-2026-52913, CVE-2026-52930, CVE-2026-52939, CVE-2026-52944, CVE-2026-52948, CVE-2026-52953,     CVE-2026-53080, CVE-2026-53134, CVE-2026-53135, CVE-2026-53140, CVE-2026-53144, CVE-2026-53150,     CVE-2026-53154, CVE-2026-53158, CVE-2026-53168, CVE-2026-53177, CVE-2026-53178, CVE-2026-53179,     CVE-2026-53181, CVE-2026-53190, CVE-2026-53208, CVE-2026-53210, CVE-2026-53213, CVE-2026-53214,     CVE-2026-53218, CVE-2026-53219, CVE-2026-53220, CVE-2026-53227, CVE-2026-53236, CVE-2026-53237,     CVE-2026-53238, CVE-2026-53242, CVE-2026-53245, CVE-2026-53249, CVE-2026-53251, CVE-2026-53252,     CVE-2026-53261, CVE-2026-53263, CVE-2026-53265, CVE-2026-53274, CVE-2026-53331, CVE-2026-53332,     CVE-2026-53336, CVE-2026-53337, CVE-2026-53339, CVE-2026-53343, CVE-2026-53345, CVE-2026-53347,     CVE-2026-53349, CVE-2026-53350, CVE-2026-53352, CVE-2026-53353, CVE-2026-63868, CVE-2026-63871,     CVE-2026-63876, CVE-2026-63877, CVE-2026-63882, CVE-2026-63883, CVE-2026-63890, CVE-2026-63891,     CVE-2026-63892, CVE-2026-63895, CVE-2026-63896, CVE-2026-63897, CVE-2026-63898, CVE-2026-63899,     CVE-2026-63900, CVE-2026-63901, CVE-2026-63902, CVE-2026-63903, CVE-2026-63904, CVE-2026-63905,     CVE-2026-63908, CVE-2026-63928, CVE-2026-63931, CVE-2026-63933, CVE-2026-63934, CVE-2026-63943,     CVE-2026-63949, CVE-2026-63956, CVE-2026-63957, CVE-2026-63958, CVE-2026-63959, CVE-2026-63960,     CVE-2026-63961, CVE-2026-63964, CVE-2026-63967, CVE-2026-63969, CVE-2026-63973, CVE-2026-63990,     CVE-2026-63991, CVE-2026-64001, CVE-2026-64006, CVE-2026-64012, CVE-2026-64014, CVE-2026-64078,     CVE-2026-64090, CVE-2026-64094, CVE-2026-64131, CVE-2026-64233, CVE-2026-64234, CVE-2026-64240,     CVE-2026-64305, CVE-2026-64329, CVE-2026-64330, CVE-2026-64340, CVE-2026-64341, CVE-2026-64342,     CVE-2026-64343, CVE-2026-64344, CVE-2026-64346, CVE-2026-64348, CVE-2026-64352, CVE-2026-64362,     CVE-2026-64363, CVE-2026-64365, CVE-2026-64407, CVE-2026-64421, CVE-2026-64424, CVE-2026-64433,     CVE-2026-64446, CVE-2026-64525, CVE-2026-64527, CVE-2026-64528, CVE-2026-74506, CVE-2026-80590,     CVE-2026-80591, CVE-2026-80593, CVE-2026-80598, CVE-2026-80599, CVE-2026-80600, CVE-2026-80601,     CVE-2026-80603, CVE-2026-80609, CVE-2026-80613, CVE-2026-80619, CVE-2026-80622, CVE-2026-80628,     CVE-2026-80630, CVE-2026-80631, CVE-2026-80634, CVE-2026-80635, CVE-2026-80637, CVE-2026-80644,     CVE-2026-80645, CVE-2026-80646, CVE-2026-80649, CVE-2026-80653, CVE-2026-80662, CVE-2026-80663,     CVE-2026-80664, CVE-2026-80668, CVE-2026-80677, CVE-2026-80678, CVE-2026-80680, CVE-2026-80681,     CVE-2026-80684, CVE-2026-80691, CVE-2026-80692, CVE-2026-80693, CVE-2026-80694, CVE-2026-80700,     CVE-2026-80702, CVE-2026-80706, CVE-2026-80707, CVE-2026-80709, CVE-2026-80710, CVE-2026-80714,     CVE-2026-80716, CVE-2026-80717, CVE-2026-80718, CVE-2026-80722, CVE-2026-80725, CVE-2026-80731,     CVE-2026-80732, CVE-2026-80737, CVE-2026-80738, CVE-2026-80747, CVE-2026-80752, CVE-2026-80754,     CVE-2026-80840, CVE-2026-80928, CVE-2026-80931, CVE-2026-80932, CVE-2026-80933, CVE-2026-80935,     CVE-2026-80937, CVE-2026-80944, CVE-2026-80945, CVE-2026-80947, CVE-2026-80952, CVE-2026-80967,     CVE-2026-80971, CVE-2026-80976, CVE-2026-80977, CVE-2026-80978, CVE-2026-80980, CVE-2026-80982,     CVE-2026-80987, CVE-2026-80989, CVE-2026-80990, CVE-2026-80991, CVE-2026-80992, CVE-2026-80994,     CVE-2026-81000, CVE-2026-81001, CVE-2026-81002, CVE-2026-81003, CVE-2026-81007, CVE-2026-81008,     CVE-2026-81011, CVE-2026-81012, CVE-2026-81016, CVE-2026-81017, CVE-2026-89440, CVE-2026-89441,     CVE-2026-89442, CVE-2026-89443, CVE-2026-89448, CVE-2026-89452, CVE-2026-89456, CVE-2026-89465,     CVE-2026-89466, CVE-2026-89469, CVE-2026-89470, CVE-2026-89471, CVE-2026-89472, CVE-2026-89476,     CVE-2026-89477, CVE-2026-89478, CVE-2026-89479, CVE-2026-89480, CVE-2026-89481, CVE-2026-89482,     CVE-2026-89483, CVE-2026-89485, CVE-2026-89487, CVE-2026-89488, CVE-2026-89489, CVE-2026-89492,     CVE-2026-89493, CVE-2026-89494, CVE-2026-89495, CVE-2026-89497, CVE-2026-89500, CVE-2026-89501,     CVE-2026-89502, CVE-2026-89503, CVE-2026-89504, CVE-2026-89508, CVE-2026-89510, CVE-2026-89511,     CVE-2026-89520, CVE-2026-89524, CVE-2026-89526, CVE-2026-89528, CVE-2026-89530, CVE-2026-89532,     CVE-2026-89533, CVE-2026-89536, CVE-2026-89537, CVE-2026-89538, CVE-2026-89540, CVE-2026-89541,     CVE-2026-89542, CVE-2026-89544, CVE-2026-89545, CVE-2026-89547, CVE-2026-89548, CVE-2026-89549,     CVE-2026-89550, CVE-2026-89551, CVE-2026-89553, CVE-2026-89554, CVE-2026-89555, CVE-2026-89557,     CVE-2026-89559, CVE-2026-89560, CVE-2026-89561, CVE-2026-89562, CVE-2026-89563, CVE-2026-89564,     CVE-2026-89569, CVE-2026-89573, CVE-2026-89574, CVE-2026-89579, CVE-2026-89580, CVE-2026-89583,     CVE-2026-89585, CVE-2026-89586, CVE-2026-89587, CVE-2026-89594, CVE-2026-89596, CVE-2026-89597,     CVE-2026-89599, CVE-2026-89601, CVE-2026-89605, CVE-2026-89606, CVE-2026-89607, CVE-2026-89608,     CVE-2026-89609, CVE-2026-89615, CVE-2026-89616, CVE-2026-89617, CVE-2026-89622, CVE-2026-89626,     CVE-2026-89631, CVE-2026-89633, CVE-2026-89634, CVE-2026-89636, CVE-2026-89637, CVE-2026-89638,     CVE-2026-89640, CVE-2026-89643, CVE-2026-89647, CVE-2026-89648, CVE-2026-89649, CVE-2026-89650,     CVE-2026-89652, CVE-2026-89653, CVE-2026-89654, CVE-2026-89655, CVE-2026-89656, CVE-2026-89657,     CVE-2026-89659, CVE-2026-89662, CVE-2026-89663, CVE-2026-89665, CVE-2026-89669, CVE-2026-89671,     CVE-2026-89672, CVE-2026-89674, CVE-2026-89676, CVE-2026-89680, CVE-2026-89682, CVE-2026-89684,     CVE-2026-89685, CVE-2026-89686, CVE-2026-89690, CVE-2026-89691, CVE-2026-89694, CVE-2026-89696,     CVE-2026-89697, CVE-2026-89699, CVE-2026-89702, CVE-2026-89704, CVE-2026-89705, CVE-2026-89706,     CVE-2026-89707, CVE-2026-89708, CVE-2026-89709, CVE-2026-89711, CVE-2026-89712, CVE-2026-89713,     CVE-2026-89720, CVE-2026-89723, CVE-2026-89724, CVE-2026-89725, CVE-2026-89729, CVE-2026-89731,     CVE-2026-89733, CVE-2026-89736, CVE-2026-89738, CVE-2026-89742, CVE-2026-89743, CVE-2026-89747,     CVE-2026-89750, CVE-2026-89755, CVE-2026-89761, CVE-2026-89762, CVE-2026-89763, CVE-2026-89774,     CVE-2026-89777, CVE-2026-89778, CVE-2026-89779, CVE-2026-89781, CVE-2026-89782, CVE-2026-89783,     CVE-2026-89786, CVE-2026-89788, CVE-2026-89789, CVE-2026-89792, CVE-2026-89793, CVE-2026-89795,     CVE-2026-89799, CVE-2026-89801, CVE-2026-89803, CVE-2026-89806, CVE-2026-89808, CVE-2026-89810,     CVE-2026-89811, CVE-2026-89819, CVE-2026-89823, CVE-2026-89832, CVE-2026-89838, CVE-2026-89840,     CVE-2026-89844, CVE-2026-89846, CVE-2026-89847, CVE-2026-89848, CVE-2026-89849, CVE-2026-89854,     CVE-2026-89856, CVE-2026-89857, CVE-2026-89860, CVE-2026-89861, CVE-2026-89863, CVE-2026-89870,     CVE-2026-89877, CVE-2026-89880, CVE-2026-89883, CVE-2026-89887, CVE-2026-89888, CVE-2026-89890,     CVE-2026-89893, CVE-2026-89894, CVE-2026-89897, CVE-2026-89899, CVE-2026-89902, CVE-2026-89903,     CVE-2026-89908, CVE-2026-89912, CVE-2026-89920, CVE-2026-89922, CVE-2026-89927, CVE-2026-89929,     CVE-2026-89930, CVE-2026-89932, CVE-2026-89938, CVE-2026-89951, CVE-2026-89954, CVE-2026-89957,     CVE-2026-89959, CVE-2026-89960, CVE-2026-89961, CVE-2026-89965, CVE-2026-89968, CVE-2026-89969,     CVE-2026-89970, CVE-2026-89972, CVE-2026-89973, CVE-2026-89979, CVE-2026-89988, CVE-2026-89992,     CVE-2026-89995, CVE-2026-89997, CVE-2026-89998, CVE-2026-89999, CVE-2026-90000, CVE-2026-90002,     CVE-2026-90003, CVE-2026-90007, CVE-2026-90011, CVE-2026-90013, CVE-2026-90016, CVE-2026-90017,     CVE-2026-90018, CVE-2026-90022, CVE-2026-90025, CVE-2026-90026, CVE-2026-90027, CVE-2026-90032,     CVE-2026-90036, CVE-2026-90037, CVE-2026-90041, CVE-2026-90042, CVE-2026-90044, CVE-2026-90045,     CVE-2026-90048, CVE-2026-90049, CVE-2026-90170, CVE-2026-92502, CVE-2026-93221)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	2026/10/8	2026/10/8	high
366664	Oracle Linux 8 : kernel (ELSA-2026-83157)	Nessus	Oracle Linux Local Security Checks	2026/10/16	2026/10/16	critical
366024	RHEL 10 : kernel (RHSA-2026:83207)	Nessus	Red Hat Local Security Checks	2026/10/15	2026/11/2	high
366667	Oracle Linux 10 : kernel (ELSA-2026-83207)	Nessus	Oracle Linux Local Security Checks	2026/10/16	2026/11/2	high
366029	RHEL 9 : kernel (RHSA-2026:83156)	Nessus	Red Hat Local Security Checks	2026/10/15	2026/11/4	critical
367391	AlmaLinux 9 : kernel (ALSA-2026:83156)	Nessus	Alma Linux Local Security Checks	2026/10/19	2026/10/19	critical
381298	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1794643812)	Nessus	Alma Linux Local Security Checks	2026/11/14	2026/11/14	high
377932	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-3389)	Nessus	Amazon Linux Local Security Checks	2026/11/9	2026/11/11	critical
376443	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel vulnerabilities (USN-8959-1)	Nessus	Ubuntu Local Security Checks	2026/11/5	2026/11/5	high
378846	RHEL 10 : kernel (RHSA-2026:98608)	Nessus	Red Hat Local Security Checks	2026/11/11	2026/11/12	high
375113	Photon OS 5.0: Linux PHSA-2026-5.0-91-1014	Nessus	PhotonOS Local Security Checks	2026/11/2	2026/11/2	high
366665	Oracle Linux 9 : kernel (ELSA-2026-83156)	Nessus	Oracle Linux Local Security Checks	2026/10/16	2026/10/16	critical
366777	Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_83156)	Nessus	Rocky Linux Local Security Checks	2026/10/17	2026/10/17	critical
346580	Linux Distros Unpatched Vulnerability : CVE-2026-90036	Nessus	Misc.	2026/9/16	2026/11/13	critical
377600	Ubuntu 24.04 LTS : Linux kernel (NVIDIA Tegra) vulnerabilities (USN-9002-1)	Nessus	Ubuntu Local Security Checks	2026/11/9	2026/11/9	high

检测

插件搜索

high

critical

high

high

critical

critical

high

critical

high

high

high

critical

critical

critical

high