The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2037:98 advisory.

    * kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)
      * kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)
      * kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP     destruction (CVE-2023-54048)
      * kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)
      * kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)
      * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
      * kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)
      * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
      * kernel: gfs2: add some missing log locking (CVE-2026-53049)
      * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
      * kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)
      * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
      * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
      * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
      * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
      * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()     (CVE-2026-63994)
      * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
      * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
      * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
      * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active     (CVE-2026-74516)
      * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
      * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
      * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)
      * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
      * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
      * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
      * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
      * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
      * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76739 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)

    * kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)

    * kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332)

    * kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076)

    * kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)

    * kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275)

    * kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317)

    * kernel: netfilter: nf_log: validate MAC header was set before dumping it (CVE-2026-52942)

    * kernel: gfs2: add some missing log locking (CVE-2026-53049)

    * kernel: netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986)

    * kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357)

    * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

    * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)

    * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)

    * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)

    * kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)

    * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)

    * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

    * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()     (CVE-2026-63994)

    * kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege     escalation (CVE-2026-64385)

    * kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557)

    * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)

    * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)

    * kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099)

    * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)

    * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

    * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

    * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)

    * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)

    * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

    * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)

    * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

    * kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)

    * kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

    * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

    * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

    * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

    * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)

    Bug Fix(es) and Enhancement(s):

    * [RHEL-9.8] kernel BUG at lib/list_debug.c:23! observed with liburing buf-ring-upgrade.t [rhel-9.8.z]     (JIRA:RHEL-254192)

    * hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info [rhel-9.8.z]     (JIRA:RHEL-262029)

    * RHEL9.4 - kernel: CPU hotplug unsupported by CPUMF [rhel-9.8.z] (JIRA:RHEL-270892)

    * Accel-DSA: dmaengine: idxd: kernel oops on unbind [rhel-9.8.z] (JIRA:RHEL-274410)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4415-1 advisory.

    This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.44 fixes various security issues:

    The following security issues were fixed:

    - CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
    - CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
    - CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()     (bsc#1272391).
    - CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
    - CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
    - CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
    - CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
    - CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
    - CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
    - CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()     (bsc#1273051).
    - CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
    - CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
    - CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
    - CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
    - CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
    - CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
    - CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
    - CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
    - CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792445930 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Just leak decrypted     memory on unrecoverable errors In CoCo VMs it is possible for the untrusted host to cause     set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers     need to take care to handle these errors to avoid returning decrypted (shared) memory to the page     allocator, which could lead to functional or security issues. Leak the decrypted memory when     set_memory_decrypted() fails, and don't need to print an error since set_memory_decrypted() will call     WARN_ONCE(). (CVE-2024-57793)

  - In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize     memory allocated via sock_kmalloc Several crypto user API contexts and requests allocated with     sock_kmalloc() were left uninitialized, relying on callers to set fields explicitly. This resulted in the     use of uninitialized data in certain error paths or when new fields are added in the future. The ACVP     patches also contain two user-space interface files: algif_kpp.c and algif_akcipher.c. These too rely on     proper initialization of their context structures. A particular issue has been observed with the newly     added 'inflight' variable introduced in af_alg_ctx by commit: 67b164a871af (crypto: af_alg - Disallow     multiple in-flight AIO requests) Because the context is not memset to zero after allocation, the inflight     variable has contained garbage values. As a result, af_alg_alloc_areq() has incorrectly returned -EBUSY     randomly when the garbage value was interpreted as true:
    https://github.com/gregkh/linux/blame/master/crypto/af_alg.c#L1209 The check directly tests ctx->inflight     without explicitly comparing against true/false. Since inflight is only ever set to true or false later,     an uninitialized value has triggered -EBUSY failures. Zero-initializing memory allocated with     sock_kmalloc() ensures inflight and other fields start in a known state, removing random issues caused by     uninitialized data. (CVE-2025-71113)

  - In the Linux kernel, the following vulnerability has been resolved: rxrpc: proc: size address buffers for     %pISpc output The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte     stack buffers with %pISpc. That is too small for the longest current-tree IPv6-with-port form the     formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a dotted-quad tail not only for     v4mapped addresses, but also for ISATAP addresses via ipv6_addr_is_isatap(). As a result, a case such as     [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535 is possible with the current formatter. That is 50     visible characters, so 51 bytes including the trailing NUL, which does not fit in the existing char[50]     buffers used by net/rxrpc/proc.c. Size the buffers from the formatter's maximum textual form and switch     the call sites to scnprintf(). Changes since v1: - correct the changelog to cite the actual maximum     current-tree case explicitly - frame the proof around the ISATAP formatting path instead of the earlier     mapped-v4 example (CVE-2026-31630)

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: check for     partial overlaps in anonymous sets Userspace provides an optimized representation in case intervals are     adjacent, where the end element is omitted. The existing partial overlap detection logic skips anonymous     set checks on start elements for this reason. However, it is possible to add intervals that overlap to     this anonymous where two start elements with the same, eg. A-B, A-C where C < B. start end A B start end A     C Restore the check on overlapping start elements to report an overlap. (CVE-2026-45873)

  - In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Bound VBIOS record-     chain walk loops [Why & How] All record-chain walk loops in bios_parser.c and bios_parser2.c use for(;;)     and only terminate on a 0xFF record_type sentinel or zero record_size. A malformed VBIOS image missing the     terminator record causes unbounded iteration at probe time, potentially hundreds of thousands of     iterations with record_size=1. In the final iterations near the BIOS image boundary, struct casts beyond     the 2-byte header validated by GET_IMAGE can also read out of bounds. Cap all 14 record-chain walk loops     to BIOS_MAX_NUM_RECORD (256) iterations. The atombios.h defines up to 22 distinct record types and     atomfirmware.h has 13. Assuming an average of less than 10 records per type (which is reasonable since     most are connector- based) 256 is a generous upper bound. (cherry picked from commit     95700a3d660287ed657d6892f7be9ffc0e294a93) (CVE-2026-53138)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
365530	MiracleLinux 8 : kernel-4.18.0-553.171.1.el8_10 (AXSA:2026-2037:98)	Nessus	Miracle Linux Local Security Checks	2026/10/14	2026/10/15	high
369302	RHEL 9 : kernel (RHSA-2026:76739)	Nessus	Red Hat Local Security Checks	2026/10/21	2026/10/21	high
362804	SUSE SLES15 Security Update : kernel RT (Live Patch 13 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:4415-1)	Nessus	SuSE Local Security Checks	2026/10/3	2026/10/3	high
364820	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-4332)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/13	high
327380	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-1924)	Nessus	Amazon Linux Local Security Checks	2026/7/16	2026/9/18	high
328493	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1968)	Nessus	Amazon Linux Local Security Checks	2026/7/20	2026/9/23	high
341024	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:3790-1)	Nessus	SuSE Local Security Checks	2026/8/27	2026/9/29	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	2026/8/26	2026/11/11	high
369490	AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792445930)	Nessus	Alma Linux Local Security Checks	2026/10/21	2026/11/13	high

检测

插件搜索

high

high

high

high

high

high

high

high

high