The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:64775 advisory.

    * kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)

    * kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)

    * kernel: udp: Fix wildcard bind conflict check when using hash2 (CVE-2026-31503)

    * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)

    * kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)

    * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

    * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)

    * kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)

    * kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)

    * kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation     (CVE-2026-53277)

    * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

    * kernel: net: add pskb_may_pull() to skb_gro_receive_list() (CVE-2026-53235)

    * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)

    * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)

    * kernel: ipv6: anycast: insert aca into global hash under idev->lock (CVE-2026-53259)

    * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()     (CVE-2026-64002)

    * kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)

    * kernel: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (CVE-2026-64265)

    * kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319)

    * kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287)

    * kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)

    * kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)

    Bug Fix(es) and Enhancement(s):

    * Customer needs netfilter: nfnetlink_queue: optimize verdict lookup with hash table patch [Rocky Linux     10.2] (JIRA:Rocky Linux-132852)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_64775 advisory.

    * kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)

    * kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)

    * kernel: udp: Fix wildcard bind conflict check when using hash2 (CVE-2026-31503)

    * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)

    * kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)

    * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

    * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)

    * kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)

    * kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)

    * kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation     (CVE-2026-53277)

    * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

    * kernel: net: add pskb_may_pull() to skb_gro_receive_list() (CVE-2026-53235)

    * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)

    * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)

    * kernel: ipv6: anycast: insert aca into global hash under idev->lock (CVE-2026-53259)

    * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()     (CVE-2026-64002)

    * kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)

    * kernel: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (CVE-2026-64265)

    * kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319)

    * kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287)

    * kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)

    * kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)

    Bug Fix(es) and Enhancement(s):

    * Customer needs netfilter: nfnetlink_queue: optimize verdict lookup with hash table patch [Rocky Linux     10.2] (JIRA:Rocky Linux-132852)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792445930 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Just leak decrypted     memory on unrecoverable errors In CoCo VMs it is possible for the untrusted host to cause     set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers     need to take care to handle these errors to avoid returning decrypted (shared) memory to the page     allocator, which could lead to functional or security issues. Leak the decrypted memory when     set_memory_decrypted() fails, and don't need to print an error since set_memory_decrypted() will call     WARN_ONCE(). (CVE-2024-57793)

  - In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize     memory allocated via sock_kmalloc Several crypto user API contexts and requests allocated with     sock_kmalloc() were left uninitialized, relying on callers to set fields explicitly. This resulted in the     use of uninitialized data in certain error paths or when new fields are added in the future. The ACVP     patches also contain two user-space interface files: algif_kpp.c and algif_akcipher.c. These too rely on     proper initialization of their context structures. A particular issue has been observed with the newly     added 'inflight' variable introduced in af_alg_ctx by commit: 67b164a871af (crypto: af_alg - Disallow     multiple in-flight AIO requests) Because the context is not memset to zero after allocation, the inflight     variable has contained garbage values. As a result, af_alg_alloc_areq() has incorrectly returned -EBUSY     randomly when the garbage value was interpreted as true:
    https://github.com/gregkh/linux/blame/master/crypto/af_alg.c#L1209 The check directly tests ctx->inflight     without explicitly comparing against true/false. Since inflight is only ever set to true or false later,     an uninitialized value has triggered -EBUSY failures. Zero-initializing memory allocated with     sock_kmalloc() ensures inflight and other fields start in a known state, removing random issues caused by     uninitialized data. (CVE-2025-71113)

  - In the Linux kernel, the following vulnerability has been resolved: rxrpc: proc: size address buffers for     %pISpc output The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte     stack buffers with %pISpc. That is too small for the longest current-tree IPv6-with-port form the     formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a dotted-quad tail not only for     v4mapped addresses, but also for ISATAP addresses via ipv6_addr_is_isatap(). As a result, a case such as     [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535 is possible with the current formatter. That is 50     visible characters, so 51 bytes including the trailing NUL, which does not fit in the existing char[50]     buffers used by net/rxrpc/proc.c. Size the buffers from the formatter's maximum textual form and switch     the call sites to scnprintf(). Changes since v1: - correct the changelog to cite the actual maximum     current-tree case explicitly - frame the proof around the ISATAP formatting path instead of the earlier     mapped-v4 example (CVE-2026-31630)

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: check for     partial overlaps in anonymous sets Userspace provides an optimized representation in case intervals are     adjacent, where the end element is omitted. The existing partial overlap detection logic skips anonymous     set checks on start elements for this reason. However, it is possible to add intervals that overlap to     this anonymous where two start elements with the same, eg. A-B, A-C where C < B. start end A B start end A     C Restore the check on overlapping start elements to report an overlap. (CVE-2026-45873)

  - In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Bound VBIOS record-     chain walk loops [Why & How] All record-chain walk loops in bios_parser.c and bios_parser2.c use for(;;)     and only terminate on a 0xFF record_type sentinel or zero record_size. A malformed VBIOS image missing the     terminator record causes unbounded iteration at probe time, potentially hundreds of thousands of     iterations with record_size=1. In the final iterations near the BIOS image boundary, struct casts beyond     the 2-byte header validated by GET_IMAGE can also read out of bounds. Cap all 14 record-chain walk loops     to BIOS_MAX_NUM_RECORD (256) iterations. The atombios.h defines up to 22 distinct record types and     atomfirmware.h has 13. Assuming an average of less than 10 records per type (which is reasonable since     most are connector- based) 256 is a generous upper bound. (cherry picked from commit     95700a3d660287ed657d6892f7be9ffc0e294a93) (CVE-2026-53138)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:91492 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (CVE-2024-36286)

    * kernel: xfrm: Duplicate SPI Handling (CVE-2025-39797)

    * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after     chip reset (CVE-2025-68745)

    * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)

    * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

    * kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)

    * kernel: Linux kernel: xfrm single-frag length not properly limited ()

    * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)

    * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

    * kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831)

    * kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)

    * kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)

    * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)

    * kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319)

    * kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490)

    * kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086)

    * kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation     (CVE-2026-68200)

    * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130)

    * kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)

    * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

    * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

    * kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522)

    * kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846)

    * kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation ()

    Bug Fix(es) and Enhancement(s):

    * kernel panics caused by NULL pointer dereferences within octeon_ep_vf [rhel-9.6.z] (JIRA:RHEL-186330)

    * Customer needs netfilter: nfnetlink_queue: optimize verdict lookup with hash table patch [rhel-9.6.z]     (JIRA:RHEL-224488)

    * Kernel panic reboot node with kernal version 5.14.0-427.68.1.el9_4 (JIRA:RHEL-260120)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-76739 advisory.

    - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950]     {CVE-2026-89690}
    - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas)     [RHEL-187734] {CVE-2026-89530}
    - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186]     {CVE-2026-89669}
    - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas)     [RHEL-264152] {CVE-2026-89663}
    - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240]     {CVE-2026-53398}
    - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480]     {CVE-2026-72317}
    - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246]     {CVE-2026-74744}
    - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103}
    - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970}
    - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365}
    - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365}
    - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408]     {CVE-2026-68291}
    - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408]     {CVE-2026-53286}
    - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408]     {CVE-2026-64162}
    - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408]     {CVE-2026-31647}
    - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar)     [RHEL-192284] {CVE-2026-53360}
    - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270]     {CVE-2026-64115}
    - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035}
    - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227}
    - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot)     [RHEL-271672] {CVE-2026-93288}
    - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822]     {CVE-2026-43332}
    - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972}
    - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670]     {CVE-2026-97417}
    - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317}
    - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611]     {CVE-2026-46275}
    - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot)     [RHEL-232611] {CVE-2026-46275}
    - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460]     {CVE-2026-89481}
    - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480}
    - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442}
    - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792}
    - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924}
    - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922}
    - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279]     {CVE-2026-63984}
    - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381]     {CVE-2026-63920}
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351]     {CVE-2026-64557}
    - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351]     {CVE-2026-64557}
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351]     {CVE-2026-64557}
    - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721]     {CVE-2026-63993}
    - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal)     [RHEL-259588] {CVE-2026-63994}
    - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774]     {CVE-2026-63992}
    - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889]     {CVE-2026-68432}
    - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004]     {CVE-2026-72052}
    - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040]     {CVE-2026-63829}
    - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot)     [RHEL-260635] {CVE-2026-74569}
    - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385}
    - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921}
    - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099}
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374]     {CVE-2026-46076}
    - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524]     {CVE-2026-74516}
    - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524]     {CVE-2026-74516}
    - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516}
    - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357}
    - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777]     {CVE-2026-53357}
    - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400]     {CVE-2026-74669}
    - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400]     {CVE-2026-74669}
    - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669}
    - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427]     {CVE-2026-72255}
    - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481]     {CVE-2026-72289}
    - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746}
    - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060]     {CVE-2026-52942}
    - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986}
    - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049}
    - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_64775 advisory.

    * kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)

    * kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)

    * kernel: udp: Fix wildcard bind conflict check when using hash2 (CVE-2026-31503)

    * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)

    * kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)

    * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

    * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)

    * kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)

    * kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)

    * kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation     (CVE-2026-53277)

    * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

    * kernel: net: add pskb_may_pull() to skb_gro_receive_list() (CVE-2026-53235)

    * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)

    * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)

    * kernel: ipv6: anycast: insert aca into global hash under idev->lock (CVE-2026-53259)

    * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()     (CVE-2026-64002)

    * kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)

    * kernel: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (CVE-2026-64265)

    * kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319)

    * kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287)

    * kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)

    * kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)

    Bug Fix(es) and Enhancement(s):

    * Customer needs netfilter: nfnetlink_queue: optimize verdict lookup with hash table patch [Rocky Linux     10.2] (JIRA:Rocky Linux-132852)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
344050	RockyLinux 10 : kernel (RLSA-2026:64775)	Nessus	Rocky Linux Local Security Checks	2026/9/9	2026/9/9	high
356399	Rocky Linux 10 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_64775)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
364820	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-4332)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/13	high
369490	AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792445930)	Nessus	Alma Linux Local Security Checks	2026/10/21	2026/10/21	high
327380	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-1924)	Nessus	Amazon Linux Local Security Checks	2026/7/16	2026/9/18	high
328493	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1968)	Nessus	Amazon Linux Local Security Checks	2026/7/20	2026/9/23	high
333762	Photon OS 5.0: Linux PHSA-2026-5.0-92-0895	Nessus	PhotonOS Local Security Checks	2026/8/10	2026/11/4	high
373996	RHEL 9 : kernel (RHSA-2026:91492)	Nessus	Red Hat Local Security Checks	2026/10/30	2026/11/4	high
329326	Photon OS 5.0: Linux PHSA-2026-5.0-0926	Nessus	PhotonOS Local Security Checks	2026/7/24	2026/10/29	high
365481	Oracle Linux 9 : kernel (ELSA-2026-76739)	Nessus	Oracle Linux Local Security Checks	2026/10/13	2026/10/13	high
363396	Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_64775)	Nessus	Rocky Linux Local Security Checks	2026/10/6	2026/10/6	high
364837	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-4241)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/13	high
365377	Ubuntu 20.04 LTS : Linux kernel (Oracle) vulnerabilities (USN-8879-1)	Nessus	Ubuntu Local Security Checks	2026/10/13	2026/10/13	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high