The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792445930 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Just leak decrypted     memory on unrecoverable errors In CoCo VMs it is possible for the untrusted host to cause     set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers     need to take care to handle these errors to avoid returning decrypted (shared) memory to the page     allocator, which could lead to functional or security issues. Leak the decrypted memory when     set_memory_decrypted() fails, and don't need to print an error since set_memory_decrypted() will call     WARN_ONCE(). (CVE-2024-57793)

  - In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize     memory allocated via sock_kmalloc Several crypto user API contexts and requests allocated with     sock_kmalloc() were left uninitialized, relying on callers to set fields explicitly. This resulted in the     use of uninitialized data in certain error paths or when new fields are added in the future. The ACVP     patches also contain two user-space interface files: algif_kpp.c and algif_akcipher.c. These too rely on     proper initialization of their context structures. A particular issue has been observed with the newly     added 'inflight' variable introduced in af_alg_ctx by commit: 67b164a871af (crypto: af_alg - Disallow     multiple in-flight AIO requests) Because the context is not memset to zero after allocation, the inflight     variable has contained garbage values. As a result, af_alg_alloc_areq() has incorrectly returned -EBUSY     randomly when the garbage value was interpreted as true:
    https://github.com/gregkh/linux/blame/master/crypto/af_alg.c#L1209 The check directly tests ctx->inflight     without explicitly comparing against true/false. Since inflight is only ever set to true or false later,     an uninitialized value has triggered -EBUSY failures. Zero-initializing memory allocated with     sock_kmalloc() ensures inflight and other fields start in a known state, removing random issues caused by     uninitialized data. (CVE-2025-71113)

  - In the Linux kernel, the following vulnerability has been resolved: rxrpc: proc: size address buffers for     %pISpc output The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte     stack buffers with %pISpc. That is too small for the longest current-tree IPv6-with-port form the     formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a dotted-quad tail not only for     v4mapped addresses, but also for ISATAP addresses via ipv6_addr_is_isatap(). As a result, a case such as     [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535 is possible with the current formatter. That is 50     visible characters, so 51 bytes including the trailing NUL, which does not fit in the existing char[50]     buffers used by net/rxrpc/proc.c. Size the buffers from the formatter's maximum textual form and switch     the call sites to scnprintf(). Changes since v1: - correct the changelog to cite the actual maximum     current-tree case explicitly - frame the proof around the ISATAP formatting path instead of the earlier     mapped-v4 example (CVE-2026-31630)

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: check for     partial overlaps in anonymous sets Userspace provides an optimized representation in case intervals are     adjacent, where the end element is omitted. The existing partial overlap detection logic skips anonymous     set checks on start elements for this reason. However, it is possible to add intervals that overlap to     this anonymous where two start elements with the same, eg. A-B, A-C where C < B. start end A B start end A     C Restore the check on overlapping start elements to report an overlap. (CVE-2026-45873)

  - In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Bound VBIOS record-     chain walk loops [Why & How] All record-chain walk loops in bios_parser.c and bios_parser2.c use for(;;)     and only terminate on a 0xFF record_type sentinel or zero record_size. A malformed VBIOS image missing the     terminator record causes unbounded iteration at probe time, potentially hundreds of thousands of     iterations with record_size=1. In the final iterations near the BIOS image boundary, struct casts beyond     the 2-byte header validated by GET_IMAGE can also read out of bounds. Cap all 14 record-chain walk loops     to BIOS_MAX_NUM_RECORD (256) iterations. The atombios.h defines up to 22 distinct record types and     atomfirmware.h has 13. Assuming an average of less than 10 records per type (which is reasonable since     most are connector- based) 256 is a generous upper bound. (cherry picked from commit     95700a3d660287ed657d6892f7be9ffc0e294a93) (CVE-2026-53138)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
369490	AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792445930)	Nessus	Alma Linux Local Security Checks	2026/10/21	2026/10/21	high
333944	Photon OS 5.0: Linux PHSA-2026-5.0-92-0864	Nessus	PhotonOS Local Security Checks	2026/8/10	2026/11/3	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	2026/8/26	2026/11/11	high

检测

插件搜索

high

high

high