The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:74133 advisory.

    * kernel: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CVE-2026-64102)

    * kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)

    * kernel: net/liquidio: drop cached VF pci_dev LUT (CVE-2026-72329)

    * kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099)

    Bug Fix(es) and Enhancement(s):

    * [Rocky Linux 8.10] kernel BUG at lib/list_debug.c:28!: list_add corruption in register_trace_event     Rocky Linux 8.10 (JIRA:Rocky Linux-214136)

    * request_key_auth use-after-free on every request-key upcall since 4.18.0-553.165.1 (regression from     CVE-2026-63823 backport) (JIRA:Rocky Linux-270349)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-75576 advisory.

    - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099}
    - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992]     {CVE-2026-64034}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:75576 advisory.

    * kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034)
      * kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099)


    Bug Fix(es) and Enhancement(s):

      * gve: backport large queue depth patches [almalinux-10.2.z] (JIRA:AlmaLinux-219261)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-76739 advisory.

    - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950]     {CVE-2026-89690}
    - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas)     [RHEL-187734] {CVE-2026-89530}
    - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186]     {CVE-2026-89669}
    - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas)     [RHEL-264152] {CVE-2026-89663}
    - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240]     {CVE-2026-53398}
    - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480]     {CVE-2026-72317}
    - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246]     {CVE-2026-74744}
    - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103}
    - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970}
    - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365}
    - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365}
    - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408]     {CVE-2026-68291}
    - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408]     {CVE-2026-53286}
    - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408]     {CVE-2026-64162}
    - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408]     {CVE-2026-31647}
    - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar)     [RHEL-192284] {CVE-2026-53360}
    - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
    - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284]     {CVE-2026-53360}
    - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270]     {CVE-2026-64115}
    - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035}
    - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227}
    - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot)     [RHEL-271672] {CVE-2026-93288}
    - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822]     {CVE-2026-43332}
    - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972}
    - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670]     {CVE-2026-97417}
    - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317}
    - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611]     {CVE-2026-46275}
    - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot)     [RHEL-232611] {CVE-2026-46275}
    - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460]     {CVE-2026-89481}
    - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480}
    - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442}
    - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792}
    - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924}
    - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922}
    - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279]     {CVE-2026-63984}
    - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381]     {CVE-2026-63920}
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351]     {CVE-2026-64557}
    - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351]     {CVE-2026-64557}
    - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351]     {CVE-2026-64557}
    - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721]     {CVE-2026-63993}
    - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal)     [RHEL-259588] {CVE-2026-63994}
    - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774]     {CVE-2026-63992}
    - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889]     {CVE-2026-68432}
    - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004]     {CVE-2026-72052}
    - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040]     {CVE-2026-63829}
    - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot)     [RHEL-260635] {CVE-2026-74569}
    - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385}
    - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921}
    - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099}
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374]     {CVE-2026-46076}
    - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524]     {CVE-2026-74516}
    - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524]     {CVE-2026-74516}
    - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516}
    - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357}
    - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777]     {CVE-2026-53357}
    - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400]     {CVE-2026-74669}
    - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400]     {CVE-2026-74669}
    - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669}
    - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427]     {CVE-2026-72255}
    - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481]     {CVE-2026-72289}
    - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746}
    - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060]     {CVE-2026-52942}
    - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986}
    - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049}
    - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-756.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read     when checking non-inheritance cfg80211_is_element_inherited() reads the first data octet of the candidate     element (id = elem->data[0]) to look it up in an extension non-inheritance list. It does so after testing     elem->id, but without verifying that the element actually has a data octet. A zero-length extension     element (WLAN_EID_EXTENSION with length 0) therefore makes it read one octet past the end of the element.
    _ieee802_11_parse_elems_full() runs this check for every element of a frame once a non-inheritance context     exists -- e.g. while parsing a per-STA profile of a Multi-Link element in a (re)association response, or a     non-transmitted BSS profile -- so a crafted frame from an AP can trigger a one-octet slab-out-of-bounds     read during element parsing: BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited Read of size     1 ... in net/wireless/scan.c Return early (treat the element as inherited) when an extension element     carries no data, mirroring the existing handling of empty ID lists. The bug was found by fuzzing     ieee802_11_parse_elems_full() under KASAN. (CVE-2026-68402)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length     underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA     length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP     header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on     iwarp_pktinfo[opcode] .hdr_len, but never compares mpa_len against that header length. siw_tcp_rx_data()     then derives srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd + MPA_HDR_SIZE; where     fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this point. For a tagged WRITE (hdr_len 16,     MPA_HDR_SIZE 2) the smallest on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below     hdr_len - MPA_HDR_SIZE underflows to a negative int. The signed value then flows into     siw_proc_write()/siw_proc_rresp() as bytes = min(srx->fpdu_part_rem, srx->skb_new); is handed to     siw_check_mem() as an int len (whose interval check addr + len > mem->va + mem->len is satisfied for a     valid base when len is negative), and reaches siw_rx_data() -> siw_rx_kva() / siw_rx_umem() ->     skb_copy_bits() as a signed copy length. The header copy branch in skb_copy_bits() promotes that to     size_t, producing a multi-gigabyte read. KASAN under a KUnit harness that drives the real kernel TCP     receive path -- a loopback AF_INET socketpair, the malformed FPDU written via kernel_sendmsg,     sk_data_ready firing in softirq, tcp_read_sock dispatching to siw_tcp_rx_data -- reports: BUG: KASAN: use-     after-free in skb_copy_bits+0x284/0x480 Read of size 4294967295 at addr ffff888... Call Trace:
    skb_copy_bits siw_rx_kva siw_rx_data siw_check_mem siw_proc_write siw_tcp_rx_data __tcp_read_sock     siw_qp_llp_data_ready tcp_data_ready tcp_data_queue Add the missing invariant at the earliest point where     the peer header is fully assembled. iwarp_pktinfo[*].hdr_len - MPA_HDR_SIZE is exactly the value the siw     transmitter uses as the minimum mpa_len for each opcode (drivers/infiniband/sw/siw/siw_qp.c:33), so this     matches the protocol contract. Out-of-range FPDUs terminate the connection with TERM_ERROR_LAYER_LLP /     LLP_ETYPE_MPA / LLP_ECODE_FPDU_START -- which is RFC 5044 Section 8 error code 3 (Marker and ULPDU Length     fields do not agree on the start of an FPDU), the correct framing-error class for this inconsistency.
    (CVE-2026-64102)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix race condition in QP     timer handlers I encontered the following warning: WARNING: drivers/infiniband/sw/rxe/rxe_task.c:249 at     rxe_sched_task+0x1c8/0x238 [rdma_rxe], CPU#0: swapper/0/0 ... libsha1 [last unloaded: ip6_udp_tunnel] CPU:
    0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G C 6.19.0-rc5-64k-v8+ #37 PREEMPT Tainted: [C]=CRAP Hardware     name: Raspberry Pi 4 Model B Rev 1.2 Call trace: rxe_sched_task+0x1c8/0x238 [rdma_rxe] (P)     retransmit_timer+0x130/0x188 [rdma_rxe] call_timer_fn+0x68/0x4d0 __run_timers+0x630/0x888 ... WARNING:
    drivers/infiniband/sw/rxe/rxe_task.c:38 at rxe_sched_task+0x1c0/0x238 [rdma_rxe], CPU#0: swapper/0/0 ...
    WARNING: drivers/infiniband/sw/rxe/rxe_task.c:111 at do_work+0x488/0x5c8 [rdma_rxe], CPU#3:
    kworker/u17:4/93400 ... refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at     refcount_warn_saturate+0x138/0x1a0, CPU#3: kworker/u17:4/93400 The issue is caused by a race condition     between retransmit_timer() and rxe_destroy_qp, leading to the Queue Pair's (QP) reference count dropping     to zero during timer handler execution. It seems this warning is harmless because rxe_qp_do_cleanup() will     flush all pending timers and requests. Example of flow causing the issue: CPU0 CPU1 retransmit_timer() {     spin_lock_irqsave rxe_destroy_qp() __rxe_cleanup() __rxe_put() // qp->ref_count decrease to 0     rxe_qp_do_cleanup() { if (qp->valid) { rxe_sched_task() { WARN_ON(rxe_read(task->qp) <= 0); } }     spin_unlock_irqrestore } spin_lock_irqsave qp->valid = 0 spin_unlock_irqrestore } Ensure the QP's     reference count is maintained and its validity is checked within the timer callbacks by adding calls to     rxe_get(qp) and corresponding rxe_put(qp) after use. (CVE-2026-45910)

  - In the Linux kernel, the following vulnerability has been resolved: ext4: fix e4b bitmap inconsistency     reports A bitmap inconsistency issue was observed during stress tests under mixed huge-page workloads.
    Ext4 reported multiple e4b bitmap check failures like: ext4_mb_complex_scan_group:2508: group 350, 8179     free clusters as per group info. But got 8192 blocks Analysis and experimentation confirmed that the issue     is caused by a race condition between page migration and bitmap modification. Although this timing window     is extremely narrow, it is still hit in practice: folio_lock ext4_mb_load_buddy __migrate_folio check ref     count folio_mc_copy __filemap_get_folio folio_try_get(folio) ...... mb_mark_used ext4_mb_unload_buddy
    __folio_migrate_mapping folio_ref_freeze folio_unlock The root cause of this issue is that the fast path     of load_buddy only increments the folio's reference count, which is insufficient to prevent concurrent     folio migration. We observed that the folio migration process acquires the folio lock. Therefore, we can     determine whether to take the fast path in load_buddy by checking the lock status. If the folio is locked,     we opt for the slow path (which acquires the lock) to close this concurrency window. Additionally, this     change addresses the following issues: When the DOUBLE_CHECK macro is enabled to inspect bitmap-related     issues, the following error may be triggered: corruption in group 324 at byte 784(6272): f in copy != ff     on disk/prealloc Analysis reveals that this is a false positive. There is a specific race window where the     bitmap and the group descriptor become momentarily inconsistent, leading to this error report:
    ext4_mb_load_buddy ext4_mb_load_buddy __filemap_get_folio(create|lock) folio_lock ext4_mb_init_cache     folio_mark_uptodate __filemap_get_folio(no lock) ...... mb_mark_used mb_mark_used_double mb_cmp_bitmaps     mb_set_bits(e4b->bd_bitmap) folio_unlock The original logic assumed that since mb_cmp_bitmaps is called     when the bitmap is newly loaded from disk, the folio lock would be sufficient to prevent concurrent     access. However, this overlooks a specific race condition: if another process attempts to load buddy and     finds the folio is already in an uptodate state, it will immediately begin using it without holding folio     lock. (CVE-2026-45942)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before     payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least     header_size(pkt) bytes long before payload_size() is used. However, payload_size() subtracts both the     attacker-controlled BTH pad field and RXE_ICRC_SIZE from pkt->paylen: payload_size = pkt->paylen -     offset[RXE_PAYLOAD] - bth_pad(pkt) - RXE_ICRC_SIZE This means a short packet can still make payload_size()     underflow even if it includes enough bytes for the fixed headers. Simply requiring header_size(pkt) +     RXE_ICRC_SIZE is not sufficient either, because a packet with a forged non-zero BTH pad can still leave     payload_size() negative and pass an underflowed value to later receive-path users. Fix this by validating     pkt->paylen against the full minimum length required by payload_size(): header_size(pkt) + bth_pad(pkt) +     RXE_ICRC_SIZE. (CVE-2026-46043)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.268-266.1092. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-132 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized

    When CONFIG_BPF_LSM=y is set, BPF inode storage maps(BPF_MAP_TYPE_INODE_STORAGE) are compiled into the     kernel. However,if the BPF LSM is not explicitly enabled at boot time (e.g. omittedfrom the lsm= boot     parameter), lsm_prepare() is never executed forthe BPF LSM.

    Consequently, the BPF inode security blob offset(bpf_lsm_blob_sizes.lbs_inode) is never initialized and     remains atits default compiled size of 8 bytes instead of being updated to avalid offset past the reserved     struct rcu_head (typically 16 bytesor more).

    When a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGEmap, bpf_inode() evaluates     inode->i_security + 8. This erroneouslyaliases the struct rcu_head.func callback pointer at the     beginningof the inode->i_security blob. During subsequent map element cleanupor inode destruction, writing     NULL to owner_storage clears the queuedRCU callback pointer. When rcu_do_batch() later executes the     queuedcallback, it attempts an instruction fetch at address 0x0, triggeringan immediate kernel panic.

    Fix this by introducing a global bpf_lsm_initialized boolean flagmarked with __ro_after_init. Set this     flag to true inside bpf_lsm_init()when the LSM framework successfully registers the BPF LSM. Gate     mapallocation in inode_storage_map_alloc() on this flag, returning-EOPNOTSUPP if the BPF LSM is in turn     uninitialized.

    This fail-fast approach prevents userspace from allocating inodestorage maps when the supporting BPF LSM     infrastructure is absent,avoiding zombie map states. (CVE-2026-64192)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: fix adapter deregistration race (CVE-2026-64279)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: fix two unsafe bare decodes in decode_lockers() (CVE-2026-68082)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: fix recursive locking deadlock in audit_dupe_exe() (CVE-2026-68096)

    In the Linux kernel, the following vulnerability has been resolved:

    super: fix emergency thaw deadlock on frozen block devices (CVE-2026-68132)

    In the Linux kernel, the following vulnerability has been resolved:

    net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Add global mutex to serialize trace_parser access (CVE-2026-68146)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CVE-2026-68159)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/virtio: bound EDID block reads to the response buffer (CVE-2026-68255)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (CVE-2026-68277)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (CVE-2026-68279)

    In the Linux kernel, the following vulnerability has been resolved:

    mmc: vub300: fix use-after-free on probe failure (CVE-2026-72073)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: Bound PR-OUT TransportID parsing to the received buffer (CVE-2026-72084)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() (CVE-2026-72087)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-verity: make error counter atomic (CVE-2026-72096)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-integrity: don't increment hash_offset twice (CVE-2026-72099)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() (CVE-2026-72225)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_pipapo: don't leak bad clone into future transaction (CVE-2026-72252)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (CVE-2026-72253)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: restrict socket queue dumps in enqueue tracepoints (CVE-2026-72299)

    In the Linux kernel, the following vulnerability has been resolved:

    mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (CVE-2026-72308)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: add INIT verification after cookie unpacking (CVE-2026-72398)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix err_chunk memory leaks in INIT handling (CVE-2026-72413)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_compat: ebtables emulation must reject non-bridge targets (CVE-2026-72416)

    In the Linux kernel, the following vulnerability has been resolved:

    xprtrdma: Repost Receive buffers for malformed replies (CVE-2026-72464)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (CVE-2026-74378)

    In the Linux kernel, the following vulnerability has been resolved:

    OPP: Fix race between OPP addition and lookup (CVE-2026-74405)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write (CVE-2026-74470)

    In the Linux kernel, the following vulnerability has been resolved:

    net: pktgen: fix proc entry use-after-free (CVE-2026-74479)

    In the Linux kernel, the following vulnerability has been resolved:

    binfmt_misc: restore write access when removing an entry (CVE-2026-74487)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: make nft_object rhltable per table (CVE-2026-74565)

    In the Linux kernel, the following vulnerability has been resolved:

    packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (CVE-2026-74594)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Use current_context for safe per-CPU buffer swap (CVE-2026-74601)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: act_gact, act_police: range check the fallback control action (CVE-2026-74620)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/huge_memory: fix huge_zero_pfn race (CVE-2026-74632)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Fix group leader use-after-free after sibling detach (CVE-2026-74637)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops (CVE-2026-74657)

    In the Linux kernel, the following vulnerability has been resolved:

    inet: frags: publish queues before arming timer (CVE-2026-74662)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: reject overly deep qdisc hierarchies (CVE-2026-74663)

    In the Linux kernel, the following vulnerability has been resolved:

    packet: synchronize pressure clearing with ring reconfiguration (CVE-2026-74666)

    In the Linux kernel, the following vulnerability has been resolved:

    packet: use consistent hard_header_len in TX_RING send path (CVE-2026-74668)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (CVE-2026-74684)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers (CVE-2026-74700)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: fix refcount race between list:set GC and swap (CVE-2026-74748)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix hanging __ceph_get_caps() with stale mds_wanted (CVE-2026-80527)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: avoid fs reclaim while using current->journal_info (CVE-2026-80528)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: fix ilock leak on error in xfs_dq_get_next_id (CVE-2026-80534)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: fix OOB read in decode_watchers() via missing bounds check (CVE-2026-80557)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: Avoid using invalid osd indices from primary_temp (CVE-2026-80558)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: fix multiple unsafe decodes in decode_locker() (CVE-2026-80561)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    In the Linux kernel, the following vulnerability has been resolved:

    inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: amba-pl011: synchronize DMA teardown (CVE-2026-80737)

    In the Linux kernel, the following vulnerability has been resolved:

    af_packet: Don't send zero-byte data in tpacket_snd(). (CVE-2026-80742)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path (CVE-2026-80744)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: do not cancel a policy conversion that never started (CVE-2026-80756)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: reject a class permission count below its inherited common (CVE-2026-80757)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: hyperv: validate initial device info bounds (CVE-2026-80765)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: fix OOB read of field->usage in hid_set_field() (CVE-2026-80781)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: reject undersized MTUs in ip_do_fragment() (CVE-2026-80793)

    In the Linux kernel, the following vulnerability has been resolved:

    xfs: validate attr entry pointer before field access (CVE-2026-80805)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: stop retrying saturated xattr cache entries (CVE-2026-80808)

    In the Linux kernel, the following vulnerability has been resolved:

    rndis_host: add overflow check in rndis_rx_fixup() (CVE-2026-80814)

    In the Linux kernel, the following vulnerability has been resolved:

    net: packet: fix wrong transport_header when sending VLAN-tagged frame (CVE-2026-80906)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: require every boolean value to be defined (CVE-2026-80913)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: fix number/pointer type confusion on long items (CVE-2026-80918)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_74133 advisory.

    * kernel: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CVE-2026-64102)

    * kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)

    * kernel: net/liquidio: drop cached VF pci_dev LUT (CVE-2026-72329)

    * kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099)

    Bug Fix(es) and Enhancement(s):

    * [Rocky Linux 8.10] kernel BUG at lib/list_debug.c:28!: list_add corruption in register_trace_event     Rocky Linux 8.10 (JIRA:Rocky Linux-214136)

    * request_key_auth use-after-free on every request-key upcall since 4.18.0-553.165.1 (regression from     CVE-2026-63823 backport) (JIRA:Rocky Linux-270349)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-74133 advisory.

    - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099}
    - net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329}
    - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809]     {CVE-2026-68299}
    - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567]     {CVE-2026-64102}
    - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983]     {CVE-2026-64034}
    - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875}
    - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753}
    - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556}
    - drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273}
    - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230}
    - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199}
    - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204}
    - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330]     {CVE-2025-40323}
    - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150]     {CVE-2026-68159}
    - libceph: Amend checking to fix make W=1 build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159}
    - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942}
    - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:75576 advisory.

    * kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034)

    * kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099)

    Bug Fix(es) and Enhancement(s):

    * gve: backport large queue depth patches [rhel-10.2.z] (JIRA:Rocky Linux-219261)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
337239	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2057)	Nessus	Amazon Linux Local Security Checks	2026/8/18	2026/9/23	high
362411	RockyLinux 8 : kernel (RLSA-2026:74133)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
364351	Oracle Linux 10 : kernel (ELSA-2026-75576)	Nessus	Oracle Linux Local Security Checks	2026/10/9	2026/10/9	critical
364704	AlmaLinux 10 : kernel (ALSA-2026:75576)	Nessus	Alma Linux Local Security Checks	2026/10/12	2026/10/12	critical
365481	Oracle Linux 9 : kernel (ELSA-2026-76739)	Nessus	Oracle Linux Local Security Checks	2026/10/13	2026/10/13	high
363461	CentOS 9 : kernel-5.14.0-756.el9	Nessus	CentOS Local Security Checks	2026/10/6	2026/10/26	critical
351061	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-132)	Nessus	Amazon Linux Local Security Checks	2026/9/29	2026/10/26	medium
365768	Ubuntu 26.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8888-1)	Nessus	Ubuntu Local Security Checks	2026/10/14	2026/10/14	medium
375804	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-8961-1)	Nessus	Ubuntu Local Security Checks	2026/11/4	2026/11/4	high
363954	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500377)	Nessus	Oracle Linux Local Security Checks	2026/10/7	2026/10/7	high
362633	Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (crlsa-2026_74133)	Nessus	Rocky Linux Local Security Checks	2026/10/2	2026/10/2	critical
362991	Oracle Linux 8 : kernel (ELSA-2026-74133)	Nessus	Oracle Linux Local Security Checks	2026/10/5	2026/10/5	critical
363144	RockyLinux 10 : kernel (RLSA-2026:75576)	Nessus	Rocky Linux Local Security Checks	2026/10/6	2026/10/6	critical
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	2026/9/4	2026/9/23	high

检测

插件搜索

high

critical

critical

critical

high

critical

medium

medium

high

high

critical

critical

critical

high