The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - sched/psi: fix race between file release and pressure write A potential race condition exists between     pressure write and cgroup file release regarding the priv member of struct kernfs_open_file, which     triggers the uaf reported in [1]. Consider the following scenario involving execution on two separate     CPUs: CPU0 CPU1 ==== ==== vfs_rmdir() kernfs_iop_rmdir() cgroup_rmdir() cgroup_kn_lock_live()     cgroup_destroy_locked() cgroup_addrm_files() cgroup_rm_file() kernfs_remove_by_name()     kernfs_remove_by_name_ns() vfs_write() __kernfs_remove() new_sync_write() kernfs_drain()     kernfs_fop_write_iter() kernfs_drain_open_files() cgroup_file_write() kernfs_release_file()     pressure_write() cgroup_file_release() ctx = of->priv; kfree(ctx); of->priv = NULL; cgroup_kn_unlock()     cgroup_kn_lock_live() cgroup_get(cgrp) cgroup_kn_unlock() if (ctx->psi.trigger) // here, trigger uaf for     ctx, that is of->priv The cgroup_rmdir() is protected by the cgroup_mutex, it also safeguards the memory     deallocation of of->priv performed within cgroup_file_release(). However, the operations involving     of->priv executed within pressure_write() are not entirely covered by the protection of cgroup_mutex.
    Consequently, if the code in pressure_write(), specifically the section handling the ctx variable executes     after cgroup_file_release() has completed, a uaf vulnerability involving of->priv is triggered. Therefore,     the issue can be resolved by extending the scope of the cgroup_mutex lock within pressure_write() to     encompass all code paths involving of->priv, thereby properly synchronizing the race condition occurring     between cgroup_file_release() and pressure_write(). And, if an live kn lock can be successfully acquired     while executing the pressure write operation, it indicates that the cgroup deletion process has not yet     reached its final stage; consequently, the priv pointer within open_file cannot be NULL. Therefore, the     operation to retrieve the ctx value must be moved to a point *after* the live kn lock has been     successfully acquired. In another situation, specifically after entering cgroup_kn_lock_live() but before     acquiring cgroup_mutex, there exists a different class of race condition: CPU0: write memory.pressure     CPU1: write cgroup.pressure=0 =========================== =============================     kernfs_fop_write_iter() kernfs_get_active_of(of) pressure_write() cgroup_kn_lock_live(memory.pressure)     cgroup_tryget(cgrp) kernfs_break_active_protection(kn) ... blocks on cgroup_mutex cgroup_pressure_write()     cgroup_kn_lock_live(cgroup.pressure) cgroup_file_show(memory.pressure, false) kernfs_show(false)     kernfs_drain_open_files() cgroup_file_release(of) kfree(ctx) of->priv = NULL cgroup_kn_unlock() ...
    acquires cgroup_mutex ctx = of->priv; // may now be NULL if (ctx->psi.trigger) // NULL dereference     Consequently, there is a possibility that of->priv is NULL, the pressure write needs to check for this.
    Now that the scope of the cgroup_mutex has been expanded, the original explicit cgroup_get/put operations     are no longer necessary, this is because acquiring/releasing the live kn lock inherently executes a cgroup     get/put operation. [1] BUG: KASAN: slab-use-after-free in pressure_write+0xa4/0x210     kernel/cgroup/cgroup.c:4011 Call Trace: pressure_write+0xa4/0x210 kernel/cgroup/cgroup.c:4011     cgroup_file_write+0x36f/0x790 kernel/cgroup/cgroup.c:43 ---truncated--- (CVE-2026-52991)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57251 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

    * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management     v4 (CVE-2026-43237)

    * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)

    * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

    * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)

    * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)

    * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)

    * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)

    * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

    * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

    * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)

    * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

    * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

    * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)

    * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)

    * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()     (CVE-2026-63888)

    * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)

    * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

    * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)

    * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)

    * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)

    * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)

    * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)

    * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)

    Bug Fix(es) and Enhancement(s):

    * CLONE - RHEL 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN     (JIRA:RHEL-223954)

    * vhost: reset the vring metadata cache on vring reconfiguration [rhel-10.2.z] (JIRA:RHEL-224545)

    * cifs: periodic IO errors when rename races with lease break [rhel-10.2.z] (JIRA:RHEL-235459)

    * cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-10.2.z] (JIRA:RHEL-235812)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
322714	Linux Distros Unpatched Vulnerability : CVE-2026-52991	Nessus	Misc.	2026/6/25	2026/11/13	high
343747	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-3345)	Nessus	Huawei Local Security Checks	2026/9/8	2026/11/3	high
347286	EulerOS Virtualization 2.12.1 : kernel (EulerOS-SA-2026-3590)	Nessus	Huawei Local Security Checks	2026/9/18	2026/11/3	high
338240	RHEL 10 : kernel (RHSA-2026:57251)	Nessus	Red Hat Local Security Checks	2026/8/20	2026/8/20	high

检测

插件搜索

high

high

high

high