The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792762308 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Synchronous access b/w     reset and tm thread for reply queue When the task management thread processes reply queues while the reset     thread resets them, the task management thread accesses an invalid queue ID (0xFFFF), set by the reset     thread, which points to unallocated memory, causing a crash. Add flag 'io_admin_reset_sync' to synchronize     access between the reset, I/O, and admin threads. Before a reset, the reset handler sets this flag to     block I/O and admin processing threads. If any thread bypasses the initial check, the reset thread waits     up to 10 seconds for processing to finish. If the wait exceeds 10 seconds, the controller is marked as     unrecoverable. (CVE-2025-37861)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: cancel mesh send     timer when hdev removed mesh_send_done timer is not canceled when hdev is removed, which causes crash if     the timer triggers after hdev is gone. Cancel the timer when MGMT removes the hdev, like other MGMT     timers. Should fix the BUG: sporadically seen by BlueZ test bot (in Mesh - Send cancel - 1 test). Log:
    ------ BUG: KASAN: slab-use-after-free in run_timer_softirq+0x76b/0x7d0 ... Freed by task 36:
    kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_save_free_info+0x3a/0x60
    __kasan_slab_free+0x43/0x70 kfree+0x103/0x500 device_release+0x9a/0x210 kobject_put+0x100/0x1e0     vhci_release+0x18b/0x240 ------ (CVE-2025-40284)

  - In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Disable periods-     elapsed work when closing PCM avs_dai_fe_shutdown() handles the shutdown procedure for HOST HDAudio stream     while period-elapsed work services its IRQs. As the former frees the DAI's private context, these two     operations shall be synchronized to avoid slab-use-after-free or worse errors. (CVE-2025-40344)

  - In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in     ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an     outer IPv4 ICMP error packet where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2 and     passed to icmp6_send(), it uses IP6CB(skb2). IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm.
    The cipso offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm at offset 18. If an     attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao would be a non-zero offset. Inside     icmp6_send(), mip6_addr_swap() is called and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO). This     would scan the inner, attacker-controlled IPv6 packet starting at that offset, potentially returning a     fake TLV without checking if the remaining packet length can hold the full 18-byte struct     ipv6_destopt_hao. Could mip6_addr_swap() then perform a 16-byte swap that extends past the end of the     packet data into skb_shared_info? Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and     ip6ip6_err() to prevent this? This patch implements the first suggestion. I am not sure if ip6ip6_err()     needs to be changed. A separate patch would be better anyway. (CVE-2026-43038)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in     rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before     copying the SRQ number to user space. If copy_to_user() fails, the function calls rxe_queue_cleanup() to     free the queue, but leaves the now-invalid pointer in 'srq->rq.queue'. The caller of rxe_srq_from_init()     (rxe_create_srq) eventually calls rxe_srq_cleanup() upon receiving the error, which triggers a second     rxe_queue_cleanup() on the same memory, leading to a double free. The call trace looks like this:
    kmem_cache_free+0x.../0x... rxe_queue_cleanup+0x1a/0x30 [rdma_rxe] rxe_srq_cleanup+0x42/0x60 [rdma_rxe]     rxe_elem_release+0x31/0x70 [rdma_rxe] rxe_create_srq+0x12b/0x1a0 [rdma_rxe] ib_create_srq_user+0x9a/0x150     [ib_core] Fix this by moving 'srq->rq.queue = q' after copy_to_user. (CVE-2026-45852)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-91565 advisory.

    - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CKI Backport Bot) [RHEL-283521]     {CVE-2026-72083}
    - md/raid5-ppl: fix use-after-free in ppl_do_flush() (Nigel Croxon) [RHEL-278085] {CVE-2026-93262}
    - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277647]     {CVE-2026-74515}
    - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270937]     {CVE-2026-89777}
    - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (Jorge San     Emeterio Villalain) [RHEL-271266] {CVE-2026-89638}
    - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232133] {CVE-2026-63978}
    - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230367]     {CVE-2026-63979}
    - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234161] {CVE-2026-64523}
    - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226096] {CVE-2026-53388}
    - net: shaper: rework the VALID marking (again) (Jamie Bainbridge) [RHEL-231705] {CVE-2026-64027}
    - net/packet: avoid fanout hook re-registration after unregister (Jamie Bainbridge) [RHEL-246967]     {CVE-2026-68338}
    - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() (Jamie Bainbridge) [RHEL-225883]     {CVE-2026-64109}
    - net: gro: fix double aggregation of flush-marked skbs (Jamie Bainbridge) [RHEL-242620] {CVE-2026-68136}
    - tcp: restrict SO_ATTACH_FILTER to priv users (Jamie Bainbridge) [RHEL-257741] {CVE-2026-53236}
    - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258583]     {CVE-2026-80824}
    - net: smc: fix splice entry lifetime imbalance in smc_rx_splice (CKI Backport Bot) [RHEL-253457]     {CVE-2026-74631}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1792247642 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: ethtool: do not perform operations on     net devices being unregistered There is a short period between a net device starts to be unregistered and     when it is actually gone. In that time frame ethtool operations could still be performed, which might end     up in unwanted or undefined behaviours[1]. Do not allow ethtool operations after a net device starts its     unregistration. This patch targets the netlink part as the ioctl one isn't affected: the reference to the     net device is taken and the operation is executed within an rtnl lock section and the net device won't be     found after unregister. [1] For example adding Tx queues after unregister ends up in NULL pointer     exceptions and UaFs, such as: BUG: KASAN: use-after-free in kobject_get+0x14/0x90 Read of size 1 at addr     ffff88801961248c by task ethtool/755 CPU: 0 PID: 755 Comm: ethtool Not tainted 5.15.0-rc6+ #778 Hardware     name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/014 Call Trace:
    dump_stack_lvl+0x57/0x72 print_address_description.constprop.0+0x1f/0x140 kasan_report.cold+0x7f/0x11b     kobject_get+0x14/0x90 kobject_add_internal+0x3d1/0x450 kobject_init_and_add+0xba/0xf0     netdev_queue_update_kobjects+0xcf/0x200 netif_set_real_num_tx_queues+0xb4/0x310     veth_set_channels+0x1c3/0x550 ethnl_set_channels+0x524/0x610 (CVE-2021-47517)

  - In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix UAF when detecting     digest errors We should also bail from the io_work loop when we set rd_enabled to true, so we don't     attempt to read data from the socket when the TCP stream is already out-of-sync or corrupted.
    (CVE-2022-48686)

  - In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free after     802.3ad slave unbind commit 0622cab0341c (bonding: fix 802.3ad aggregator reselection), resolve case,     when there is several aggregation groups in the same bond. bond_3ad_unbind_slave will invalidate (clear)     aggregator when __agg_active_ports return zero. So, ad_clear_agg can be executed even, when     num_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for, previously cleared aggregator.
    NOTE: at this time bond_3ad_unbind_slave will not update slave ports list, because lag_ports==NULL. So,     here we got slave ports, pointing to freed aggregator memory. Fix with checking actual number of ports in     group (as was before commit 0622cab0341c (bonding: fix 802.3ad aggregator reselection) ), before     ad_clear_agg(). The KASAN logs are as follows: [ 767.617392]     ================================================================== [ 767.630776] BUG: KASAN: use-after-     free in bond_3ad_state_machine_handler+0x13dc/0x1470 [ 767.638764] Read of size 2 at addr ffff00011ba9d430     by task kworker/u8:7/767 [ 767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G O 5.15.11 #15 [     767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT) [ 767.660760] Workqueue: lacp_1     bond_3ad_state_machine_handler [ 767.666468] Call trace: [ 767.668930] dump_backtrace+0x0/0x2d0 [     767.672625] show_stack+0x24/0x30 [ 767.675965] dump_stack_lvl+0x68/0x84 [ 767.679659]     print_address_description.constprop.0+0x74/0x2b8 [ 767.685451] kasan_report+0x1f0/0x260 [ 767.689148]
    __asan_load2+0x94/0xd0 [ 767.692667] bond_3ad_state_machine_handler+0x13dc/0x1470 (CVE-2022-49667)

  - In the Linux kernel, the following vulnerability has been resolved: bpf: Do mark_chain_precision for     ARG_CONST_ALLOC_SIZE_OR_ZERO Precision markers need to be propagated whenever we have an ARG_CONST_* style     argument, as the verifier cannot consider imprecise scalars to be equivalent for the purposes of     states_equal check when such arguments refine the return value (in this case, set mem_size for     PTR_TO_MEM). The resultant mem_size for the R0 is derived from the constant value, and if the verifier     incorrectly prunes states considering them equivalent where such arguments exist (by seeing that both     registers have reg->precise as false in regsafe), we can end up with invalid programs passing the verifier     which can do access beyond what should have been the correct mem_size in that explored state. To show a     concrete example of the problem: 0000000000000000 <prog>: 0: r2 = *(u32 *)(r1 + 80) 1: r1 = *(u32 *)(r1 +     76) 2: r3 = r1 3: r3 += 4 4: if r3 > r2 goto +18 <LBB5_5> 5: w2 = 0 6: *(u32 *)(r1 + 0) = r2 7: r1 = *(u32
    *)(r1 + 0) 8: r2 = 1 9: if w1 == 0 goto +1 <LBB5_3> 10: r2 = -1 0000000000000058 <LBB5_3>: 11: r1 = 0 ll     13: r3 = 0 14: call bpf_ringbuf_reserve 15: if r0 == 0 goto +7 <LBB5_5> 16: r1 = r0 17: r1 += 16777215 18:
    w2 = 0 19: *(u8 *)(r1 + 0) = r2 20: r1 = r0 21: r2 = 0 22: call bpf_ringbuf_submit 00000000000000b8     <LBB5_5>: 23: w0 = 0 24: exit For the first case, the single line execution's exploration will prune the     search at insn 14 for the branch insn 9's second leg as it will be verified first using r2 = -1     (UINT_MAX), while as w1 at insn 9 will always be 0 so at runtime we don't get error for being greater than     UINT_MAX/4 from bpf_ringbuf_reserve. The verifier during regsafe just sees reg->precise as false for both     r2 registers in both states, hence considers them equal for purposes of states_equal. If we propagated     precise markers using the backtracking support, we would use the precise marking to then ensure that old     r2 (UINT_MAX) was within the new r2 (1) and this would never be true, so the verification would rightfully     fail. The end result is that the out of bounds access at instruction 19 would be permitted without this     fix. Note that reg->precise is always set to true when user does not have CAP_BPF (or when subprog count     is greater than 1 (i.e. use of any static or global functions)), hence this is only a problem when     precision marks need to be explicitly propagated (i.e. privileged users with CAP_BPF). A simplified test     case has been included in the next patch to prevent future regressions. (CVE-2022-49961)

  - A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.
    (CVE-2023-2162)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
371428	Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792762308)	Nessus	Rocky Linux Local Security Checks	2026/10/23	2026/10/23	high
373633	Oracle Linux 10 : kernel (ELSA-2026-91565)	Nessus	Oracle Linux Local Security Checks	2026/10/29	2026/10/29	medium
366854	CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1792247642)	Nessus	CentOS Local Security Checks	2026/10/17	2026/10/17	high

检测

插件搜索

high

medium

high