遠端 Oracle Linux 10 / 9 主機中安裝的套件受到 ELSA-2026-50160 公告中提及的多個弱點影響。

    - mm/hugetlb：修正 hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
    - platform/x86：classmate-laptop：新增缺少的 NULL 指標檢查 (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
    - scsi: qla2xxx：修正造成重複釋放的 bsg_done() (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
    - wifi：rtl8xxxu：修正 rtl8xxxu_sta_add 中的 slab 超出邊界 (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
    - xfs：修正 xchk_btree_check_block_owner 中的 UAF (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
    - scsi：qla2xxx：釋放錯誤路徑中的 sp 以修正系統當機 (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
    - scsi：qla2xxx：進行光纖掃描時，延遲模組卸載 (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
    - scsi：qla2xxx：釋放相關記憶體前驗證 sp (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
    - wifi：rtw88：修正 rtw_core_enable_beacon() 中的對齊錯誤 (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
    - crypto：virtio - 使用 virtqueue 通知新增執行緒同步鎖定保護 (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
    - crypto：iaa - 修正 find_empty_iaa_compression_mode 中的超出邊界索引 (Thorsten Blum) [Orabug:
    38997976] {CVE-2025-71231}
    - smb：用戶端：分割 cached_fid 位元欄位以避免共用位元組 RMW 爭用 (Henrique Carvalho) [Orabug:
    38998059] {CVE-2026-23230}
    - spi：tegra210-quad：保護 tegra_qspi_combined_seq_xfer 中的 curr_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
    - ASoC：amd：修正 acp3x pdm dma ops 中的記憶體洩漏 (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
    - ipv6：修正清除 RTF_ADDRCONF 時的 ECMP 同級計數不相符 (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
    - netfilter：nf_tables：修正 nft_map_catchall_activate() 中的反向 genmask 檢查 (Andrew Fasano) [Orabug:
    38970170] {CVE-2026-23111}
    - net：usb：r8152：修正繼續重設鎖死 (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
    - macvlan：修正 macvlan_common_newlink() 中的錯誤復原 (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
    - net/sched：cls_u32：使用 skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
    - smb/client：修正 smb2_open_file() 中的記憶體洩漏 (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
    - btrfs：如果 fs 為完全唯讀，則拒絕新交易 (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
    - scsi：目標：iscsi：修正 iscsit_dec_conn_usage_count() 中的釋放後使用 (Maurizio Lombardi) [Orabug:
    38985169] {CVE-2026-23216}
    - scsi：目標：iscsi：修正 iscsit_dec_session_usage_count() 中的釋放後使用 (Maurizio Lombardi) [Orabug:
    38970453] {CVE-2026-23193}
    - nvmet-tcp：修正 nvmet_tcp_listen_data_ready() 中的懸置 (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
    - drm/amd/pm：在 SMU 模式 1 重設期間停用 MMIO 存取 (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
    - HID：i2c-hid：修正 i2c_hid_get_report() 中的潛在緩衝區溢位 (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
    - md：透過 sysfs 更新 raid_disks 時暫停陣列 (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
    - wifi: wlcore：確保 skb_push 之前的 skb 空餘空間 (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
    - wifi：mac80211：ocb：當未加入介面時，略過 rx_no_sta (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
    - procfs：避免在保留 VMA 鎖定時擷取版本 ID (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
    - mm、shmem：防止截斷爭用時發生無限迴圈 (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
    - ceph：修正 parse_longname() 中 kfree() 的無效指標所導致的 oops (Daniel Vogelbacher) [Orabug:
    38970590] {CVE-2026-23201}
    - ceph：修正 ceph_mds_auth_match() 中的 NULL 指標解除參照 (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
    - mm/slab：為 memcg_alloc_abort_single 新增 alloc_tagging_slab_free_hook (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
    - ALSA：aloop：修正 PCM 觸發時的爭用存取 (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
    - x86/vmware：修正 hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
    - nvmet-tcp：在 nvmet_tcp_build_pdu_iovec 中新增邊界檢查 (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
    - perf：sched：使用新的 is_user_task() 協助程式修正 perf 損毀 (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
    - wifi：ath11k：在監控模式中為 ath11k_hal_srng_* 新增 srng->lock (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
    - drm/amdgpu：修正 amdgpu_gmc_filter_faults_remove 中的 NULL 指標解除參照 (Jon Doron) [Orabug:
    38970348] {CVE-2026-23163}
    - net：修正轉送 fraglist GRO 的分割 (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
    - mm/shmem、swap：修正截斷爭用和交換項目分割 (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
    - flex_proportions：使 fprop_new_period() hardirq 安全 (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
    - nvmet：修正 nvmet_bio_done() 中導致 NULL 指標解除參照的爭用 (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
    - efivarfs：修正 efivar_entry_get() 中的錯誤傳播 (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
    - net/mlx5e：TC，僅刪除現有對等端的流程 (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
    - ice：修正 ice_vsi_set_napi_queues 中的 NULL 指標解除參照 (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
    - rocker：修正 rocker_world_port_post_fini() 中的記憶體洩漏 (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
    - bonding：標註 slave->last_rx 周邊的資料爭用 (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
    - 藍牙：MGMT：修正 set_ssp_complete 中的記憶體洩漏 (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
    - 藍牙：hci_uart：修正 hci_uart_write_work 中的 null-ptr-deref (Jia- Hong Su) [Orabug: 38970604] {CVE-2026-23146}
    - wifi：ath11k：在 reaping 監控目的地環時修正 RCU 停止 (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
    - btrfs：修正 btrfs_clear_space_info_full() 中的 racy 位元欄位寫入 (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
    - sched_ext：修正 deferred_irq_workfn() 中可能發生的鎖死 (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
    - exfat：修正 exfat_find 中的 refcount 洩漏 (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
    - bpf：不讓 BPF 測試基礎結構發出無效的 GSO 類型至堆疊 (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
    - 移轉：更正 hugetlb 檔案 folios 的鎖定順序 (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
    - can：usb_8dev：usb_8dev_read_bulk_callback()：修正 URB 記憶體洩漏 (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
    - can：kvaser_usb：kvaser_usb_read_bulk_callback()：修正 URB 記憶體洩漏 (Marc Kleine-Budde) [Orabug: 
    38930881] {CVE-2026-23061}
    - can：ems_usb：ems_usb_read_bulk_callback()：修正 URB 記憶體洩漏 (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
    - irqchip/gic-v3-its：避免截斷記憶體位址 (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
    - intel_th：修正輸出 open() 上的裝置洩漏 (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
    - 追蹤：修正合成堆疊追蹤欄位使用時發生的當機問題 (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
    - arm64：在 swsusp_arch_resume() 上設定 __nocfi (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
    - arm64/fpsimd：訊號：還原 ZA 時配置 SSVE 儲存空間 (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
    - wifi：rsi：修正因未設定 vif 驅動程式資料大小而導致的記憶體損毀 (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
    - wifi：ath10k：修正 dma_free_coherent() 指標 (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
    - ALSA：usb-audio：修正 snd_usb_mixer_free() 中的釋放後使用 (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
    - ALSA：scarlett2：修正設定擷取中的緩衝區溢位 (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
    - ALSA：ctxfi：修正音訊混音器處理中的潛在 OOB 存取 (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
    - leds：led-class：僅在 leds_list 完全準備就緒時，將 LED 新增至 leds_list (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
    - dpll：防止重複註冊 (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
    - vsock/virtio：將 TX 認可設定為本機緩衝區大小的上限 (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
    - vsock/virtio：修正 virtio_transport_get_credit() 中的潛在反向溢位 (Melbin K Mathew) [Orabug:
    38930919] {CVE-2026-23069}
    - bonding：提供 __skb_flow_dissect() 的 net 指標 (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
    - be2net：修正 be_cmd_get_mac_from_list 中的 NULL 指標解除參照 (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
    - ipv6：標註 ndisc_router_discovery() 中的資料爭用 (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
    - netdevsim：修正一個與 bpf_bound_progs 清單作業相關的爭用問題 (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
    - scsi：qla2xxx：清理承載大小以防止成員溢位 (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
    - scsi：core：當最終完成項目彼此爭用時喚醒錯誤處置程式 (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
    - regmap：修正 hwspinlock irqsave 常式中的爭用情形 (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
    - 互連：debugfs：將 src_node 和 dst_node 初始化為空字串 (Georgi Djakov) [Orabug:
    38970218] {CVE-2026-23123}
    - io_uring/io-wq：檢查工作執行迴圈內的 IO_WQ_BIT_EXIT (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
    - platform/x86：hp-bioscfg：修正 GET_INSTANCE_ID 巨集中的核心錯誤 (Mario Limonciello) [Orabug：
    38930890] {CVE-2026-23062}
    - platform/x86：hp-bioscfg：修正空白屬性名稱的 kobject 警告 (Mario Limonciello) [Orabug:
    38970247] {CVE-2026-23131}
    - scsi：xen：scsiback：修正 scsiback_remove() 中的潛在記憶體洩漏 (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
    - w1：therm：修正 alarms_store 中的差一緩衝區溢位 (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
    - crypto：authencesn - 拒絕過短 AAD (assoclen<8) 以符合 ESP/ESN 規格 (Taeyang Lee) [Orabug:
    38930874] {CVE-2026-23060}
    - net/sched：qfq：使用 cl_is_active 判斷 qfq_rm_from_ag 中的類別是否為使用中 (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
    - net/sched：強制 teql 只能作為 root qdisc 使用 (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
    - ipvlan：將 addrs_lock 設為各連接埠獨立擁有 (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
    - l2tp：避免 l2tp_tunnel_del_work() 中的一個資料爭用情形 (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
    - gue：使用內部 IP 通訊協定 0 修正 skb memleak (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
    - sctp：將 SCTP_CMD_ASSOC_SHKEY 移到 SCTP_CMD_PEER_INIT 之後 (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
    - can：gs_usb: gs_usb_receive_bulk_callback()：在 usb_submit_urb() 錯誤上取消錨定 URL (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
    - l2tp：修正 l2tp_udp_encap_recv() 中的 memleak  (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
    - bonding：將 BOND_MODE_8023AD 限制為僅乙太網路裝置支援 (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
    - vsock/virtio：僅合併線性 skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}

Tenable 已直接從 Oracle Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 Oracle Linux 10 / 9 主机上安装的多个程序包受到 ELSA-2026-50160 公告中提及的多个漏洞影响。

    - mm/hugetlb：修复 hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
    - platform/x86：classmate-laptop：添加缺失的空指针检查 (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
    - scsi：qla2xxx：修复造成双重释放的 bsg_done() (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
    - wifi：rtl8xxxu：修复 rtl8xxxu_sta_add 中的 slab 越界 (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
    - xfs：修复 xchk_btree_check_block_owner 中的 UAF (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
    - scsi：qla2xxx：释放错误路径中的 sp 以修复系统崩溃 (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
    - scsi：qla2xxx：在结构扫描进行期间延迟模块卸载 (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
    - scsi：qla2xxx：在释放相关内存之前验证 sp (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
    - wifi：rtw88：修复 rtw_core_enable_beacon() 中的对齐错误 (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
    - crypto：virtio - 为 virtqueue 通知添加旋锁保护 (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
    - crypto：iaa - 修复 find_empty_iaa_compression_mode 中的越界索引 (Thorsten Blum) [Orabug：
    38997976] {CVE-2025-71231}
    - smb：client：拆分 cached_fid 位字段以避免共享字节 RMW 争用 (Henrique Carvalho) [Orabug：
    38998059] {CVE-2026-23230}
    - spi：tegra210-quad：保护 tegra_qspi_combined_seq_xfer 中的 curr_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
    - ASoC：amd：修复 acp3x pdm dma ops 中的内存泄漏 (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
    - ipv6：修复清除 RTF_ADDRCONF 时的 ECMP 同级计数不匹配 (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
    - netfilter：nf_tables：修复 nft_map_catchall_activate() 中的反向 genmask 检查 (Andrew Fasano) [Orabug：
    38970170] {CVE-2026-23111}
    - net: usb: r8152：修复恢复重置死锁 (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
    - macvlan：修复 macvlan_common_newlink() 中的错误恢复 (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
    - net/sched：cls_u32：使用 skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
    - smb/client：修复 smb2_open_file() 中的内存泄漏 (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
    - btrfs：如果 fs 完全只读，则拒绝新的事务 (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
    - scsi：target：iscsi：修复 iscsit_dec_conn_usage_count() 中的释放后使用 (Maurizio Lombardi) [Orabug：
    38985169] {CVE-2026-23216}
    - scsi：target：iscsi：修复 iscsit_dec_session_usage_count() 中的释放后使用 (Maurizio Lombardi) [Orabug：
    38970453] {CVE-2026-23193}
    - nvmet-tcp：修复 nvmet_tcp_listen_data_ready() 中的挂起 (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
    - drm/amd/pm：在 SMU 模式 1 重置期间禁用 MMIO 访问 (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
    - HID：i2c-hid：修复 i2c_hid_get_report() 中的潜在缓冲区溢出 (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
    - md：通过 sysfs 更新 raid_disks 时暂停数组 (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
    - wifi：wlcore：在 skb_push 前确保 skb 余量 (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
    - wifi：mac80211：ocb：未加入接口时，跳过 rx_no_sta (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
    - procfs：避免在保持 VMA 锁定时获取版本 ID (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
    - mm, shmem：防止截断争用时无限循环 (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
    - ceph：修复由于 parse_longname() 中 kfree() 的指针无效而导致的 oops (Daniel Vogelbacher) [Orabug：
    38970590] {CVE-2026-23201}
    - ceph：修复 ceph_mds_auth_match() 中的空指针取消引用 (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
    - mm/slab：添加 memcg_alloc_abort_single 的 alloc_tagging_slab_free_hook (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
    - ALSA：aloop：修复 PCM 触发时的 racy 访问 (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
    - x86/vmware：修复超级调用破坏 (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
    - nvmet-tcp：在 nvmet_tcp_build_pdu_iovec 中添加边界检查 (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
    - perf：sched：使用新的 is_user_task() 帮助程序修复 perf 崩溃 (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
    - wifi：ath11k：在监控模式下，为 ath11k_hal_srng_* 添加 srng->lock (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
    - drm/amdgpu：修复 amdgpu_gmc_filter_faults_remove 中的空指针取消引用 (Jon Doron) [Orabug：
    38970348] {CVE-2026-23163}
    - net：修复转发 fraglist GRO 的分段 (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
    - mm/shmem，swap：修复截断和交换条目拆分的争用 (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
    - flex_proportions：使 fprop_new_period() 在硬中断上下文中安全 (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
    - nvmet：修复 nvmet_bio_done() 中导致空指针取消引用的争用 (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
    - efivarfs：修复 efivar_entry_get() 中的错误传播 (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
    - net/mlx5e：TC，仅删除现有对等机的流 (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
    - ice：修复 ice_vsi_set_napi_queues 中的空指针取消引用 (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
    - rocker：修复 rocker_world_port_post_fini() 中的内存泄漏 (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
    - bonding：针对围绕 slave->last_rx 的数据争用添加注释 (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
    - Bluetooth：MGMT：修复 set_ssp_complete 中的内存泄漏 (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
    - Bluetooth：hci_uart：修复 hci_uart_write_work 中的 null-ptr-deref (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
    - wifi：ath11k：修复在回收监控目标环形缓冲区时发生的 RCU 停滞 (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
    - btrfs：修复 btrfs_clear_space_info_full() 中的 racy 位域写入 (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
    - sched_ext：修复 deferred_irq_workfn() 中可能的死锁 (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
    - exfat：修复 exfat_find 中的 refcount 泄漏 (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
    - bpf：禁止 BPF 测试基础设施向网络协议栈发出无效的 GSO 类型 (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
    - migrate：更正 hugetlb 文件作品集的锁定顺序 (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
    - can：usb_8dev: usb_8dev_read_bulk_callback()：修复 URB 内存泄漏 (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
    - can：kvaser_usb：kvaser_usb_read_bulk_callback()：修复 URB 内存泄漏 (Marc Kleine-Budde) [Orabug: 
    38930881] {CVE-2026-23061}
    - can：ems_usb：ems_usb_read_bulk_callback()：修复 URB 内存泄漏 (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
    - irqchip/gic-v3-its：避免截断内存地址 (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
    - intel_th：修复输出 open() 上的设备泄漏 (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
    - tracing：修复在使用合成堆栈跟踪字段时出现的崩溃问题 (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
    - arm64：在 swsusp_arch_resume() 上设置 __nocfi (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
    - arm64/fpsimd: signal：还原 ZA 时分配 SSVE 存储 (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
    - wifi：rsi：修复因未设置 vif 驱动程序数据大小而导致的内存损坏 (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
    - wifi：ath10k：修复 dma_free_coherent() 指针 (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
    - ALSA：usb-audio：修复 snd_usb_mixer_free() 中的释放后使用 (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
    - ALSA：scarlett2：修复配置检索中的缓冲区溢出 (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
    - ALSA：ctxfi：修复音频混合器处理中潜在的 OOB 访问 (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
    - leds：led-class：仅在完全准备就绪时将 LED 添加到 leds_list (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
    - dpll：防止重复注册 (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
    - vsock/virtio：将 TX credit 限制为本地缓冲区大小 (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
    - vsock/virtio：修复 virtio_transport_get_credit() 中潜在的下溢 (Melbin K Mathew) [Orabug：
    38930919] {CVE-2026-23069}
    - bonding：提供指向 __skb_flow_dissect() 的网络指针 (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
    - be2net：修复 be_cmd_get_mac_from_list 中的空指针取消引用 (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
    - ipv6：为 ndisc_router_discovery() 中的数据争用添加注释 (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
    - netdevsim：修复与 bpf_bound_progs 列表操作相关的争用问题 (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
    - scsi：qla2xxx：审查负载大小以防止成员溢出 (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
    - scsi：core：最终完成之间相互争用时唤醒错误处理程序 (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
    - regmap：修复 hwspinlock irqsave 例程中的争用条件 (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
    - interconnect：debugfs：将 src_node 和 dst_node 初始化为空字符串 (Georgi Djakov) [Orabug：
    38970218] {CVE-2026-23123}
    - io_uring/io-wq：检查工作运行循环内部的 IO_WQ_BIT_EXIT (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
    - platform/x86：hp-bioscfg：修复 GET_INSTANCE_ID 宏中的内核错误 (Mario Limonciello) [Orabug：
    38930890] {CVE-2026-23062}
    - platform/x86：hp-bioscfg：修复空属性名称的 kobject 警告 (Mario Limonciello) [Orabug：
    38970247] {CVE-2026-23131}
    - scsi：xen：scsiback：修复 scsiback_remove() 中的潜在内存泄漏 (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
    - w1：therm：修复 alarms_store 中的差一缓冲区溢出 (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
    - crypto：authencesn - 拒绝不符合 ESP/ESN 规范的过短 AAD (assoclen<8) (Taeyang Lee) [Orabug：
    38930874] {CVE-2026-23060}
    - net/sched: qfq：使用 cl_is_active 确定类在 qfq_rm_from_ag 中是否活动 (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
    - net/sched：强制 teql 只能用作根 qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
    - ipvlan：按端口设置 addrs_lock (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
    - l2tp：避免 l2tp_tunnel_del_work() 中的数据争用 (Eric Dumazet) [Orabug：38970202] {CVE-2026-23120}
    - gue：修复内部 IP 协议 0 的 skb 内存泄露。(Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
    - sctp：在 SCTP_CMD_PEER_INIT 之后移动 SCTP_CMD_ASSOC_SHKEY (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
    - can：gs_usb：gs_usb_receive_bulk_callback()：usb_submit_urb() 错误中的非定位 URL (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
    - l2tp：修复 l2tp_udp_encap_recv() 中的内存泄漏。(Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
    - bonding：将 BOND_MODE_8023AD 限制为以太网设备 (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
    - vsock/virtio：仅合并线性的 skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}

Tenable 已直接从 Oracle Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Oracle Linux 10 / 9 主机上安装的多个程序包受到 ELSA-2026-50232 公告中提及的多个漏洞影响。

    - ipv6：在 ip6_xmit() 中使用 RCU (Eric Dumazet) [Orabug: 39202432] {CVE-2025-40135}
    - dst：修复 rt6_uncached_list_del() 和 rt_del_uncached_list() 中的争用 (Eric Dumazet) [Orabug: 39202431] {CVE-2026-23004}
    - netfilter：nf_tables：修复 nf_tables_addchain() 中的释放后使用 (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
    - KVM：x86/mmu：即使创建 MMIO SPTE，也终止/清除现有 SPTE (Sean Christopherson) [Orabug: 39153394] {CVE-2026-23401}

Tenable 已直接从 Oracle Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

遠端 Oracle Linux 10 / 9 主機中安裝的套件受到 ELSA-2026-50232 公告中提及的多個弱點影響。

    - ipv6：在 ip6_xmit() 中使用 RCU (Eric Dumazet) [Orabug: 39202432] {CVE-2025-40135}
    - dst：修正 rt6_uncached_list_del() 和 rt_del_uncached_list() 中的爭用 (Eric Dumazet) [Orabug: 39202431] {CVE-2026-23004}
    - netfilter：nf_tables：修正 nf_tables_addchain() 中的釋放後使用 (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
    - KVM：x86/mmu：即使在建立 MMIO SPTE 時，也中斷/刪除現有的 SPTE (Sean Christopherson) [Orabug: 39153394] {CVE-2026-23401}

Tenable 已直接從 Oracle Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 已解決 Linux 核心中的下列弱點：net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq kvzalloc_node is not doing a runtime check on the node argument (__alloc_pages_node_noprof does have a VM_BUG_ON, but it expands to nothing on !CONFIG_DEBUG_VM builds), so doing any ethtool/netlink operation that calls mlx5e_open on a CPU that's larger that MAX_NUMNODES triggers OOB access and panic (see the trace below). Add missing cpu_to_node call to convert cpu id to node id. [ 165.427394] mlx5_core 0000:5c:00.0 beth1: Link up [ 166.479327] BUG: unable to handle page fault for address: 0000000800000010 [ 166.494592] #PF: supervisor read access in kernel mode [ 166.505995] #PF: error_code(0x0000) - not-present page ... [ 166.816958] Call Trace: [ 166.822380] <TASK> [166.827034] ? __die_body+0x64/0xb0 [ 166.834774] ? page_fault_oops+0x2cd/0x3f0 [ 166.843862] ? exc_page_fault+0x63/0x130 [ 166.852564] ? asm_exc_page_fault+0x22/0x30 [ 166.861843] ?
    __kvmalloc_node_noprof+0x43/0xd0 [ 166.871897] ? get_partial_node+0x1c/0x320 [ 166.880983] ? deactivate_slab+0x269/0x2b0 [ 166.890069] ___slab_alloc+0x521/0xa90 [ 166.898389] ?
    __kvmalloc_node_noprof+0x43/0xd0 [ 166.908442] __kmalloc_node_noprof+0x216/0x3f0 [ 166.918302] ?
    __kvmalloc_node_noprof+0x43/0xd0 [ 166.928354] __kvmalloc_node_noprof+0x43/0xd0 [ 166.938021] mlx5e_open_channels+0x5e2/0xc00 [ 166.947496] mlx5e_open_locked+0x3e/0xf0 [ 166.956201] mlx5e_open+0x23/0x50 [ 166.963551] __dev_open+0x114/0x1c0 [ 166.971292] __dev_change_flags+0xa2/0x1b0 [166.980378] dev_change_flags+0x21/0x60 [ 166.988887] do_setlink+0x38d/0xf20 [ 166.996628] ? ep_poll_callback+0x1b9/0x240 [ 167.005910] ? __nla_validate_parse.llvm.10713395753544950386+0x80/0xd70 [167.020782] ? __wake_up_sync_key+0x52/0x80 [ 167.030066] ? __mutex_lock+0xff/0x550 [ 167.038382] ? security_capable+0x50/0x90 [ 167.047279] rtnl_setlink+0x1c9/0x210 [ 167.055403] ? ep_poll_callback+0x1b9/0x240 [ 167.064684] ? security_capable+0x50/0x90 [ 167.073579] rtnetlink_rcv_msg+0x2f9/0x310 [ 167.082667] ? rtnetlink_bind+0x30/0x30 [ 167.091173] netlink_rcv_skb+0xb1/0xe0 [ 167.099492] netlink_unicast+0x20f/0x2e0 [ 167.108191] netlink_sendmsg+0x389/0x420 [ 167.116896] __sys_sendto+0x158/0x1c0 [ 167.125024]
    __x64_sys_sendto+0x22/0x30 [ 167.133534] do_syscall_64+0x63/0x130 [ 167.141657] ?
    __irq_exit_rcu.llvm.17843942359718260576+0x52/0xd0 [ 167.155181] entry_SYSCALL_64_after_hwframe+0x4b/0x53 (CVE-2025-21717)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 已修复 Linux 内核中的下列漏洞：net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq kvzalloc_node is not doing a runtime check on the node argument (__alloc_pages_node_noprof does have a VM_BUG_ON, but it expands to nothing on !CONFIG_DEBUG_VM builds), so doing any ethtool/netlink operation that calls mlx5e_open on a CPU that's larger that MAX_NUMNODES triggers OOB access and panic (see the trace below). Add missing cpu_to_node call to convert cpu id to node id. [ 165.427394] mlx5_core 0000:5c:00.0 beth1: Link up [ 166.479327] BUG: unable to handle page fault for address: 0000000800000010 [ 166.494592] #PF: supervisor read access in kernel mode [ 166.505995] #PF: error_code(0x0000) - not-present page ... [ 166.816958] Call Trace: [ 166.822380] <TASK> [166.827034] ? __die_body+0x64/0xb0 [ 166.834774] ? page_fault_oops+0x2cd/0x3f0 [ 166.843862] ? exc_page_fault+0x63/0x130 [ 166.852564] ? asm_exc_page_fault+0x22/0x30 [ 166.861843] ?
    __kvmalloc_node_noprof+0x43/0xd0 [ 166.871897] ? get_partial_node+0x1c/0x320 [ 166.880983] ? deactivate_slab+0x269/0x2b0 [ 166.890069] ___slab_alloc+0x521/0xa90 [ 166.898389] ?
    __kvmalloc_node_noprof+0x43/0xd0 [ 166.908442] __kmalloc_node_noprof+0x216/0x3f0 [ 166.918302] ?
    __kvmalloc_node_noprof+0x43/0xd0 [ 166.928354] __kvmalloc_node_noprof+0x43/0xd0 [ 166.938021] mlx5e_open_channels+0x5e2/0xc00 [ 166.947496] mlx5e_open_locked+0x3e/0xf0 [ 166.956201] mlx5e_open+0x23/0x50 [ 166.963551] __dev_open+0x114/0x1c0 [ 166.971292] __dev_change_flags+0xa2/0x1b0 [166.980378] dev_change_flags+0x21/0x60 [ 166.988887] do_setlink+0x38d/0xf20 [ 166.996628] ? ep_poll_callback+0x1b9/0x240 [ 167.005910] ? __nla_validate_parse.llvm.10713395753544950386+0x80/0xd70 [167.020782] ? __wake_up_sync_key+0x52/0x80 [ 167.030066] ? __mutex_lock+0xff/0x550 [ 167.038382] ? security_capable+0x50/0x90 [ 167.047279] rtnl_setlink+0x1c9/0x210 [ 167.055403] ? ep_poll_callback+0x1b9/0x240 [ 167.064684] ? security_capable+0x50/0x90 [ 167.073579] rtnetlink_rcv_msg+0x2f9/0x310 [ 167.082667] ? rtnetlink_bind+0x30/0x30 [ 167.091173] netlink_rcv_skb+0xb1/0xe0 [ 167.099492] netlink_unicast+0x20f/0x2e0 [ 167.108191] netlink_sendmsg+0x389/0x420 [ 167.116896] __sys_sendto+0x158/0x1c0 [ 167.125024]
    __x64_sys_sendto+0x22/0x30 [ 167.133534] do_syscall_64+0x63/0x130 [ 167.141657] ?
    __irq_exit_rcu.llvm.17843942359718260576+0x52/0xd0 [ 167.155181] entry_SYSCALL_64_after_hwframe+0x4b/0x53 (CVE-2025-21717)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

リモートの Oracle Linux 10 / 9 ホストに、ELSA-2026-50160 アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

    - mm/hugetlb: hugetlb_pmd_shared() を修正します (David Hildenbrand 氏) [Orabug: 38931087] {CVE-2026-23100}
    - platform/x86: classmate-laptop: NULL ポインターチェックの不足を追加します (Rafael J. Wysocki 氏) [Orabug: 39044501] {CVE-2026-23237}
    - scsi: qla2xxx: bsg_done() が二重解放を引き起こす問題を修正します (Anil Gurumurthy 氏) [Orabug: 39044457] {CVE-2025-71238}
    - wifi: rtl8xxxu: rtl8xxxu_sta_add() におけるスラブ領域外アクセスを修正します (Ali Tariq 氏) [Orabug: 38997990] {CVE-2025-71234}
    - xfs: xchk_btree_check_block_owner() におけるメモリ解放後使用 (Use-After-Free) を修正します (Darrick J. Wong 氏) [Orabug: 38998028] {CVE-2026-23223}
    - scsi: qla2xxx: エラー パスで sp を解放し、システム クラッシュを修正します (Anil Gurumurthy 氏) [Orabug: 38997979] {CVE-2025-71232}
    - scsi: qla2xxx: ファブリックスキャンの実行中はモジュールのアンロードを遅延します (Anil Gurumurthy 氏) [Orabug: 38997992] {CVE-2025-71235}
    - scsi: qla2xxx: 関連するメモリを解放する前に sp を検証します (Anil Gurumurthy 氏) [Orabug: 38997998] {CVE-2025-71236}
    - wifi: rtw88: rtw_core_enable_beacon() におけるアラインメントエラーを修正します (Bitterblue Smith 氏) [Orabug: 38997972] {CVE-2025-71229}
    - crypto: virtio - virtqueue 通知に対するスピンロック保護を追加します (Bibo Mao 氏) [Orabug: 38998052] {CVE-2026-23229}
    - crypto: iaa - find_empty_iaa_compression_mode() における範囲外インデックスを修正します (Thorsten Blum 氏) [Orabug:
    38997976] {CVE-2025-71231}
    - smb: client: 共有バイトの RMW 競合を回避するため、cached_fid のビットフィールドを分割します (Henrique Carvalho 氏) [Orabug:
    38998059] {CVE-2026-23230}
    - spi: tegra210-quad: tegra_qspi_combined_seq_xfer() における curr_xfer を保護します (Breno Leitao 氏) [Orabug: 38970593] {CVE-2026-23202}
    - ASoC: amd: acp3x pdm DMA ops におけるメモリリークを修正します (Chris Bainbridge 氏) [Orabug: 38970441] {CVE-2026-23190}
    - ipv6: RTF_ADDRCONF をクリアする際の ECMP シスリング数の不一致を修正します (Shigeru Yoshida 氏) [Orabug: 38970598] {CVE-2026-23200}
    - netfilter: nf_tables: nft_map_catchall_activate() における genmask の逆チェックを修正します (Andrew Fasano 氏) [Orabug:
    38970170] {CVE-2026-23111}
    - net: usb: r8152: 再開時のリセットにおけるデッドロックを修正します (Sergey Senozhatsky 氏) [Orabug: 38970438] {CVE-2026-23188}
    - macvlan: macvlan_common_newlink() におけるエラー回復処理を修正します (Eric Dumazet 氏) [Orabug: 38970508] {CVE-2026-23209}
    - net/sched: cls_u32: skb_header_pointer_careful() を使用します (Eric Dumazet 氏) [Orabug: 38970487] {CVE-2026-23204}
    - smb/client: smb2_open_file() におけるメモリリークを修正します (Chenxiaosong 氏) [Orabug: 38970578] {CVE-2026-23205}
    - btrfs: ファイルシステムが完全に読み取り専用の場合、新規トランザクションを拒否します (Qu Wenruo 氏) [Orabug: 38985156] {CVE-2026-23214}
    - scsi: target: iscsi: iscsit_dec_conn_usage_count() におけるメモリ解放後使用 (Use-After-Free) を修正します (Maurizio Lombardi 氏) [Orabug:
    38985169] {CVE-2026-23216}
    - scsi: target: iscsi: iscsit_dec_session_usage_count() におけるメモリ解放後使用 (Use-After-Free) を修正します (Maurizio Lombardi 氏) [Orabug:
    38970453] {CVE-2026-23193}
    - nvmet-tcp: nvmet_tcp_listen_data_ready() におけるハングを修正します (Hannes Reinecke 氏) [Orabug: 38970416] {CVE-2026-23179}
    - drm/amd/pm: SMU モード 1 リセット中は MMIO アクセスを無効にします (Perry Yuan 氏) [Orabug: 38985149] {CVE-2026-23213}
    - HID: i2c-hid: i2c_hid_get_report() における潜在的なバッファオーバーフローを修正します (Kwok Kin Ming 氏) [Orabug: 38970413] {CVE-2026-23178}
    - md: sysfs を通じて raid_disks を更新する間、配列を一時停止します (Danny Shih 氏) [Orabug: 38985108] {CVE-2025-71225}
    - wifi: wlcore: skb_push の前に skb ヘッドルームを確保します (Peter Astrand 氏) [Orabug: 38970152] {CVE-2025-71222}
    - wifi: mac80211: ocb: インターフェースが参加していない場合は rx_no_sta をスキップします (Moon Hee Lee 氏) [Orabug: 38970163] {CVE-2025-71224}
    - procfs: VMA ロック保持中のビルド ID の取得を回避します (Andrii Nakryiko 氏) [Orabug: 38970476] {CVE-2026-23199}
    - mm, shmem: truncate の競合による無限ループを防ぎます (Kairui Song 氏) [Orabug: 38970409] {CVE-2026-23177}
    - ceph: parse_longname() における kfree() 用の不正なポインタによる Oops を修正します (Daniel Vogelbacher 氏) [Orabug:
    38970590] {CVE-2026-23201}
    - ceph: ceph_mds_auth_match() における NULL ポインターデリファレンスを修正します (Viacheslav Dubeyko 氏) [Orabug: 38970595] {CVE-2026-23189}
    - mm/slab: memcg_alloc_abort_single 用の alloc_tagging_slab_free_hook を追加します (Hao Ge 氏) [Orabug: 38985192] {CVE-2026-23219}
    - ALSA: aloop: PCM トリガーでの競合アクセスを修正します (Takashi Iwai 氏) [Orabug: 38970445] {CVE-2026-23191}
    - x86/vmware: ハイパーコールの上書きを修正します (Josh Poimboeuf 氏) [Orabug: 38985163] {CVE-2026-23215}
    - nvmet-tcp: nvmet_tcp_build_pdu_iovec() に境界チェックを追加します (Yunje Shin 氏) [Orabug: 38970176] {CVE-2026-23112}
    - perf: sched: 新しい is_user_task() ヘルパーでの perf クラッシュを修正します (Steven Rostedt 氏) [Orabug: 38970581] {CVE-2026-23159}
    - wifi: ath11k: モニターモードにおいて ath11k_hal_srng_* に srng->lock を追加します (Kang Yang 氏) [Orabug: 37844126] {CVE-2024-58096}
    - drm/amdgpu: amdgpu_gmc_filter_faults_remove() における NULL ポインターデリファレンスを修正します (Jon Doron 氏) [Orabug:
    38970348] {CVE-2026-23163}
    - net: forwarding fraglist GRO のセグメンテーションを修正します (Jibin Zhang 氏) [Orabug: 38970318] {CVE-2026-23154}
    - mm/shmem, swap: truncate と swap エントリーの分割の競合を修正します (Kairui Song 氏) [Orabug: 38970345] {CVE-2026-23161}
    - flex_proportions: fprop_new_period() hardirq を安全にします (Jan Kara 氏) [Orabug: 38970373] {CVE-2026-23168}
    - nvmet: nvmet_bio_done() における競合が NULL ポインターデリファレンスを引き起こす問題を修正します (Ming Lei 氏) [Orabug: 38970608] {CVE-2026-23148}
    - efivarfs: efivar_entry_get() におけるエラー伝播を修正します (Kohei Enju 氏) [Orabug: 38970325] {CVE-2026-23156}
    - net/mlx5e: TC、既存のピアに対してのみフローを削除します (Mark Bloch 氏) [Orabug: 38970397] {CVE-2026-23173}
    - ice: ice_vsi_set_napi_queues() における NULL ポインターデリファレンスを修正します (Aaron Ma 氏) [Orabug: 38970364] {CVE-2026-23166}
    - rocker: rocker_world_port_post_fini() におけるメモリリークを修正します (Kery Qi 氏) [Orabug: 38970351] {CVE-2026-23164}
    - bonding: slave->last_rx 周辺のデータ競合を注釈します (Eric Dumazet 氏) [Orabug: 38985142] {CVE-2026-23212}
    - Bluetooth: MGMT: set_ssp_complete() におけるメモリリークを修正します (Jianpeng Chang 氏) [Orabug: 38970587] {CVE-2026-23151}
    - Bluetooth: hci_uart: hci_uart_write_work() における NULL ポインターデリファレンスを修正します (Jia-Hong Su 氏) [Orabug: 38970604] {CVE-2026-23146}
    - wifi: ath11k: モニターの宛先リングの回収中に発生する RCU ストールを修正します (P Praneesh 氏) [Orabug: 37844129] {CVE-2024-58097}
    - btrfs: btrfs_clear_space_info_full() におけるビットフィールドの競合書き込みを修正します (Boris Burkov 氏) [Orabug: 38798802] {CVE-2025-68358}
    - sched_ext: deferred_irq_workfn() における潜在的なデッドロックを修正します (Zqiang 氏) [Orabug: 38792605] {CVE-2025-68333}
    - exfat: exfat_find() における refcount 漏洩を修正します (Shuhao Fu 氏) [Orabug: 38798780] {CVE-2025-68351}
    - bpf: BPF テストインフラが無効な GSO タイプをスタックに出力しないようにします (Daniel Borkmann 氏) [Orabug: 38798881] {CVE-2025-68725}
    - migrate: hugetlb ファイルフォリオに対するロック順序を修正します (Matthew Wilcox 氏) [Orabug: 38931066] {CVE-2026-23097}
    - can: usb_8dev: usb_8dev_read_bulk_callback(): URB のメモリリークを修正します (Marc Kleine-Budde 氏) [Orabug: 38931120] {CVE-2026-23108}
    - can: kvaser_usb: kvaser_usb_read_bulk_callback(): URB のメモリリークを修正します (Marc Kleine-Budde 氏) [Orabug:
    38930881] {CVE-2026-23061}
    - can: ems_usb: ems_usb_read_bulk_callback(): URB のメモリリークを修正します (Marc Kleine-Budde 氏) [Orabug: 38930859] {CVE-2026-23058}
    - irqchip/gic-v3-its: メモリアドレスの切り捨てを回避します (Arnd Bergmann 氏) [Orabug: 38931001] {CVE-2026-23085}
    - intel_th: output open() におけるデバイスリークを修正します (Johan Hovold 氏) [Orabug: 38931040] {CVE-2026-23091}
    - tracing: synthetic stacktrace フィールドの使用時のクラッシュを修正します (Steven Rostedt 氏) [Orabug: 38931024] {CVE-2026-23088}
    - arm64: swsusp_arch_resume() に __nocfi を設定します (Zhaoyang Huang 氏) [Orabug: 38970241] {CVE-2026-23128}
    - arm64/fpsimd: signal: ZA の復元時に SSVE ストレージを割り当てます (Mark Rutland 氏) [Orabug: 38931118] {CVE-2026-23107}
    - wifi: rsi: vif ドライバデータサイズ未設定によるメモリ破損を修正します (Marek Vasut 氏) [Orabug: 38930939] {CVE-2026-23073}
    - wifi: ath10k: dma_free_coherent() のポインタを修正します (Thomas Fourier 氏) [Orabug: 38970253] {CVE-2026-23133}
    - ALSA: usb-audio: snd_usb_mixer_free() におけるメモリ解放後使用 (Use-After-Free) を修正します (Berk Cem Goksel 氏) [Orabug: 38931029] {CVE-2026-23089}
    - ALSA: scarlett2: config 取得時のバッファオーバーフローを修正します (Samasth Norway Ananda 氏) [Orabug: 38930973] {CVE-2026-23078}
    - ALSA: ctxfi: オーディオミキサー処理における潜在的な OOB アクセスを修正します (Takashi Iwai 氏) [Orabug: 38930966] {CVE-2026-23076}
    - leds: led-class: LED が完全に準備できている場合にのみ leds_list に追加します (Hans de Goede 氏) [Orabug: 38931091] {CVE-2026-23101}
    - dpll: 重複登録を防ぎます (Ivan Vecera 氏) [Orabug: 38970244] {CVE-2026-23129}
    - vsock/virtio: TX クレジットをローカルバッファサイズに制限します (Melbin K Mathew 氏) [Orabug: 38931008] {CVE-2026-23086}
    - vsock/virtio: virtio_transport_get_credit() における潜在的なアンダーフローを修正します (Melbin K Mathew 氏) [Orabug:
    38930919] {CVE-2026-23069}
    - bonding: __skb_flow_dissect() に net ポインタを渡します (Eric Dumazet 氏) [Orabug: 38970199] {CVE-2026-23119}
    - be2net: be_cmd_get_mac_from_list() における NULL ポインターデリファレンスを修正します (Andrey Vatoropin 氏) [Orabug: 38930992] {CVE-2026-23084}
    - ipv6: ndisc_router_discovery() におけるデータ競合を注釈します (Eric Dumazet 氏) [Orabug: 38970222] {CVE-2026-23124}
    - netdevsim: bpf_bound_progs リストの操作に関連する競合問題を修正します (Yun Lu 氏) [Orabug: 38970233] {CVE-2026-23126}
    - scsi: qla2xxx: メンバーオーバーフローを防ぐためにペイロードサイズをサニタイズします (Jiasheng Jiang 氏) [Orabug: 38930867] {CVE-2026-23059}
    - scsi: core: 最終完了が競合した場合にエラーハンドラーを起動します (David Jeffery 氏) [Orabug: 38931132] {CVE-2026-23110}
    - regmap: hwspinlock irqsave ルーチンでの競合状態を修正します (Cheng-Yu Lee 氏) [Orabug: 38930930] {CVE-2026-23071}
    - interconnect: debugfs: src_node および dst_node を空文字列で初期化します (Georgi Djakov 氏) [Orabug:
    38970218] {CVE-2026-23123}
    - io_uring/io-wq: work 実行ループ内で IO_WQ_BIT_EXIT をチェックします (Jens Axboe 氏) [Orabug: 38970181] {CVE-2026-23113}
    - platform/x86: hp-bioscfg: GET_INSTANCE_ID マクロでのカーネルパニックを修正します (Mario Limonciello 氏) [Orabug:
    38930890] {CVE-2026-23062}
    - platform/x86: hp-bioscfg: 空の属性名に対する kobject 警告を修正します (Mario Limonciello 氏) [Orabug:
    38970247] {CVE-2026-23131}
    - scsi: xen: scsiback: scsiback_remove() における潜在的なメモリリークを修正します (Abdun Nihaal 氏) [Orabug: 38931014] {CVE-2026-23087}
    - w1: therm: alarms_store における off-by-one のバッファオーバーフローを修正します (Thorsten Blum 氏) [Orabug: 38930796] {CVE-2025-71197}
    - crypto: authencesn - ESP/ESN 仕様に合わせて、短すぎる AAD (assoclen<8) を拒否します (Taeyang Lee 氏) [Orabug:
    38930874] {CVE-2026-23060}
    - net/sched: qfq: qfq_rm_from_ag でクラスがアクティブかどうかを cl_is_active で判定します (Jamal Hadi Salim 氏) [Orabug: 38931110] {CVE-2026-23105}
    - net/sched: teql をルート qdisc としてのみ使用できるように強制します (Jamal Hadi Salim 氏) [Orabug: 38930948] {CVE-2026-23074}
    - ipvlan: addrs_lock をポートごとに分割します (Dmitry Skorodumov 氏) [Orabug: 38931102] {CVE-2026-23103}
    - l2tp: l2tp_tunnel_del_work() における 1 つのデータ競合を回避します (Eric Dumazet 氏) [Orabug: 38970202] {CVE-2026-23120}
    - gue: 内部 IP プロトコル 0 での skb メモリリークを修正します (Kuniyuki Iwashima 氏) [Orabug: 38931057] {CVE-2026-23095}
    - sctp: SCTP_CMD_PEER_INIT の直後に SCTP_CMD_ASSOC_SHKEY を移動します (Xin Long 氏) [Orabug: 38970225] {CVE-2026-23125}
    - can: gs_usb: gs_usb_receive_bulk_callback(): usb_submit_urb() エラー時に URL のアンカーを解除します (Marc Kleine-Budde 氏) [Orabug: 38931184] {CVE-2026-23082}
    - l2tp: l2tp_udp_encap_recv() のメモリリークを修正します。(Kuniyuki Iwashima 氏) [Orabug: 38930935] {CVE-2026-23072}
    - bonding: BOND_MODE_8023AD をイーサネット デバイスに限定します (Eric Dumazet 氏) [Orabug: 38931079] {CVE-2026-23099}
    - vsock/virtio: リニア skb のみを結合します (Michal Luczaj 氏) [Orabug: 38930857] {CVE-2026-23057}

Tenable は、前述の記述ブロックを Oracle Linux セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートの Oracle Linux 10 / 9 ホストに、ELSA-2026-50232 アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

    - ipv6: ip6_xmit() で RCU を使用 (Eric Dumazet) [Orabug: 39202432] {CVE-2025-40135}
    - dst: rt6_uncached_list_del() と rt_del_uncached_list() における競合状態を修正 (Eric Dumazet) [Orabug: 39202431] {CVE-2026-23004}
    - netfilter: nf_tables: nf_tables_addchain() におけるメモリ解放後使用 (use-after-free) を修正 (Inseo An) [Orabug: 39044468] {CVE-2026-23231}
    - KVM: x86/mmu: MMIO SPTE を作成する場合でも、既存の有効な SPTE を削除/フラッシュするよう修正 (Sean Christopherson) [Orabug: 39153394] {CVE-2026-23401}

Tenable は、前述の記述ブロックを Oracle Linux セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Linux カーネルでは、以下の脆弱性が解決されています: net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq kvzalloc_node is not doing a runtime check on the node argument (__alloc_pages_node_noprof does have a VM_BUG_ON, but it expands to nothing on !CONFIG_DEBUG_VM builds), so doing any ethtool/netlink operation that calls mlx5e_open on a CPU that's larger that MAX_NUMNODES triggers OOB access and panic (see the trace below). Add missing cpu_to_node call to convert cpu id to node id. [ 165.427394] mlx5_core 0000:5c:00.0 beth1: Link up [ 166.479327] BUG: unable to handle page fault for address: 0000000800000010 [ 166.494592] #PF: supervisor read access in kernel mode [ 166.505995] #PF: error_code(0x0000) - not-present page ... [ 166.816958] Call Trace: [ 166.822380] <TASK> [166.827034] ? __die_body+0x64/0xb0 [ 166.834774] ? page_fault_oops+0x2cd/0x3f0 [ 166.843862] ? exc_page_fault+0x63/0x130 [ 166.852564] ? asm_exc_page_fault+0x22/0x30 [ 166.861843] ?
    __kvmalloc_node_noprof+0x43/0xd0 [ 166.871897] ? get_partial_node+0x1c/0x320 [ 166.880983] ? deactivate_slab+0x269/0x2b0 [ 166.890069] ___slab_alloc+0x521/0xa90 [ 166.898389] ?
    __kvmalloc_node_noprof+0x43/0xd0 [ 166.908442] __kmalloc_node_noprof+0x216/0x3f0 [ 166.918302] ?
    __kvmalloc_node_noprof+0x43/0xd0 [ 166.928354] __kvmalloc_node_noprof+0x43/0xd0 [ 166.938021] mlx5e_open_channels+0x5e2/0xc00 [ 166.947496] mlx5e_open_locked+0x3e/0xf0 [ 166.956201] mlx5e_open+0x23/0x50 [ 166.963551] __dev_open+0x114/0x1c0 [ 166.971292] __dev_change_flags+0xa2/0x1b0 [166.980378] dev_change_flags+0x21/0x60 [ 166.988887] do_setlink+0x38d/0xf20 [ 166.996628] ? ep_poll_callback+0x1b9/0x240 [ 167.005910] ? __nla_validate_parse.llvm.10713395753544950386+0x80/0xd70 [167.020782] ? __wake_up_sync_key+0x52/0x80 [ 167.030066] ? __mutex_lock+0xff/0x550 [ 167.038382] ? security_capable+0x50/0x90 [ 167.047279] rtnl_setlink+0x1c9/0x210 [ 167.055403] ? ep_poll_callback+0x1b9/0x240 [ 167.064684] ? security_capable+0x50/0x90 [ 167.073579] rtnetlink_rcv_msg+0x2f9/0x310 [ 167.082667] ? rtnetlink_bind+0x30/0x30 [ 167.091173] netlink_rcv_skb+0xb1/0xe0 [ 167.099492] netlink_unicast+0x20f/0x2e0 [ 167.108191] netlink_sendmsg+0x389/0x420 [ 167.116896] __sys_sendto+0x158/0x1c0 [ 167.125024]
    __x64_sys_sendto+0x22/0x30 [ 167.133534] do_syscall_64+0x63/0x130 [ 167.141657] ?
    __irq_exit_rcu.llvm.17843942359718260576+0x52/0xd0 [ 167.155181] entry_SYSCALL_64_after_hwframe+0x4b/0x53 (CVE-2025-21717)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: add missing cpu_to_node to     kvzalloc_node in mlx5e_open_xdpredirect_sq kvzalloc_node is not doing a runtime check on the node argument     (__alloc_pages_node_noprof does have a VM_BUG_ON, but it expands to nothing on !CONFIG_DEBUG_VM builds),     so doing any ethtool/netlink operation that calls mlx5e_open on a CPU that's larger that MAX_NUMNODES     triggers OOB access and panic (see the trace below). Add missing cpu_to_node call to convert cpu id to     node id. [ 165.427394] mlx5_core 0000:5c:00.0 beth1: Link up [ 166.479327] BUG: unable to handle page     fault for address: 0000000800000010 [ 166.494592] #PF: supervisor read access in kernel mode [ 166.505995]     #PF: error_code(0x0000) - not-present page ... [ 166.816958] Call Trace: [ 166.822380] <TASK> [     166.827034] ? __die_body+0x64/0xb0 [ 166.834774] ? page_fault_oops+0x2cd/0x3f0 [ 166.843862] ?     exc_page_fault+0x63/0x130 [ 166.852564] ? asm_exc_page_fault+0x22/0x30 [ 166.861843] ?
    __kvmalloc_node_noprof+0x43/0xd0 [ 166.871897] ? get_partial_node+0x1c/0x320 [ 166.880983] ?     deactivate_slab+0x269/0x2b0 [ 166.890069] ___slab_alloc+0x521/0xa90 [ 166.898389] ?
    __kvmalloc_node_noprof+0x43/0xd0 [ 166.908442] __kmalloc_node_noprof+0x216/0x3f0 [ 166.918302] ?
    __kvmalloc_node_noprof+0x43/0xd0 [ 166.928354] __kvmalloc_node_noprof+0x43/0xd0 [ 166.938021]     mlx5e_open_channels+0x5e2/0xc00 [ 166.947496] mlx5e_open_locked+0x3e/0xf0 [ 166.956201]     mlx5e_open+0x23/0x50 [ 166.963551] __dev_open+0x114/0x1c0 [ 166.971292] __dev_change_flags+0xa2/0x1b0 [     166.980378] dev_change_flags+0x21/0x60 [ 166.988887] do_setlink+0x38d/0xf20 [ 166.996628] ?     ep_poll_callback+0x1b9/0x240 [ 167.005910] ? __nla_validate_parse.llvm.10713395753544950386+0x80/0xd70 [     167.020782] ? __wake_up_sync_key+0x52/0x80 [ 167.030066] ? __mutex_lock+0xff/0x550 [ 167.038382] ?     security_capable+0x50/0x90 [ 167.047279] rtnl_setlink+0x1c9/0x210 [ 167.055403] ?     ep_poll_callback+0x1b9/0x240 [ 167.064684] ? security_capable+0x50/0x90 [ 167.073579]     rtnetlink_rcv_msg+0x2f9/0x310 [ 167.082667] ? rtnetlink_bind+0x30/0x30 [ 167.091173]     netlink_rcv_skb+0xb1/0xe0 [ 167.099492] netlink_unicast+0x20f/0x2e0 [ 167.108191]     netlink_sendmsg+0x389/0x420 [ 167.116896] __sys_sendto+0x158/0x1c0 [ 167.125024]
    __x64_sys_sendto+0x22/0x30 [ 167.133534] do_syscall_64+0x63/0x130 [ 167.141657] ?
    __irq_exit_rcu.llvm.17843942359718260576+0x52/0xd0 [ 167.155181] entry_SYSCALL_64_after_hwframe+0x4b/0x53     (CVE-2025-21717)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50160 advisory.

    - mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
    - platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501]     {CVE-2026-23237}
    - scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
    - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990]     {CVE-2025-71234}
    - xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
    - scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979]     {CVE-2025-71232}
    - scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992]     {CVE-2025-71235}
    - scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998]     {CVE-2025-71236}
    - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972]     {CVE-2025-71229}
    - crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052]     {CVE-2026-23229}
    - crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug:
    38997976] {CVE-2025-71231}
    - smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug:
    38998059] {CVE-2026-23230}
    - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593]     {CVE-2026-23202}
    - ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
    - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598]     {CVE-2026-23200}
    - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug:
    38970170] {CVE-2026-23111}
    - net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
    - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508]     {CVE-2026-23209}
    - net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
    - smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
    - btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156]     {CVE-2026-23214}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug:
    38985169] {CVE-2026-23216}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug:
    38970453] {CVE-2026-23193}
    - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416]     {CVE-2026-23179}
    - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
    - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413]     {CVE-2026-23178}
    - md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
    - wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
    - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163]     {CVE-2025-71224}
    - procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476]     {CVE-2026-23199}
    - mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
    - ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug:
    38970590] {CVE-2026-23201}
    - ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595]     {CVE-2026-23189}
    - mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192]     {CVE-2026-23219}
    - ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
    - x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
    - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176]     {CVE-2026-23112}
    - perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581]     {CVE-2026-23159}
    - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126]     {CVE-2024-58096}
    - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug:
    38970348] {CVE-2026-23163}
    - net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
    - mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345]     {CVE-2026-23161}
    - flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
    - nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608]     {CVE-2026-23148}
    - efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
    - net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
    - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364]     {CVE-2026-23166}
    - rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
    - bonding: annotate data-races around slave->last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
    - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587]     {CVE-2026-23151}
    - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604]     {CVE-2026-23146}
    - wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129]     {CVE-2024-58097}
    - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802]     {CVE-2025-68358}
    - sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605]     {CVE-2025-68333}
    - exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
    - bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881]     {CVE-2025-68725}
    - migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066]     {CVE-2026-23097}
    - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120]     {CVE-2026-23108}
    - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug:
    38930881] {CVE-2026-23061}
    - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859]     {CVE-2026-23058}
    - irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001]     {CVE-2026-23085}
    - intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
    - tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024]     {CVE-2026-23088}
    - arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
    - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118]     {CVE-2026-23107}
    - wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939]     {CVE-2026-23073}
    - wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
    - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029]     {CVE-2026-23089}
    - ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973]     {CVE-2026-23078}
    - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966]     {CVE-2026-23076}
    - leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091]     {CVE-2026-23101}
    - dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
    - vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
    - vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug:
    38930919] {CVE-2026-23069}
    - bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199]     {CVE-2026-23119}
    - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992]     {CVE-2026-23084}
    - ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
    - netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233]     {CVE-2026-23126}
    - scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867]     {CVE-2026-23059}
    - scsi: core: Wake up the error handler when final completions race against each other (David Jeffery)     [Orabug: 38931132] {CVE-2026-23110}
    - regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930]     {CVE-2026-23071}
    - interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug:
    38970218] {CVE-2026-23123}
    - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181]     {CVE-2026-23113}
    - platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug:
    38930890] {CVE-2026-23062}
    - platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug:
    38970247] {CVE-2026-23131}
    - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014]     {CVE-2026-23087}
    - w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796]     {CVE-2025-71197}
    - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Taeyang Lee) [Orabug:
    38930874] {CVE-2026-23060}
    - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi     Salim) [Orabug: 38931110] {CVE-2026-23105}
    - net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948]     {CVE-2026-23074}
    - ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
    - l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
    - gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
    - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225]     {CVE-2026-23125}
    - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde)     [Orabug: 38931184] {CVE-2026-23082}
    - l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
    - bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
    - vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50232 advisory.

    - ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
    - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]     {CVE-2026-23004}
    - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]     {CVE-2026-23231}
    - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)     [Orabug: 39153394]  {CVE-2026-23401}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01951-1 advisory.

    The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
    - CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
    - CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
    - CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
    - CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
    - CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
    - CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
    - CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
    - CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround     (bsc#1235712).
    - CVE-2024-49570: drm/xe/tracing: Fix a potential TP_printk UAF (bsc#1238782).
    - CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg     (bsc#1235733).
    - CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
    - CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
    - CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
    - CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
    - CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
    - CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
    - CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
    - CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
    - CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
    - CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq'     (bsc#1235524).
    - CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
    - CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
    - CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
    - CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
    - CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
    - CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
    - CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
    - CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
    - CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
    - CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
    - CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
    - CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
    - CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
    - CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
    - CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
    - CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
    - CVE-2024-58074: drm/i915: Grab intel_display from the encoder to avoid potential (bsc#1238972).
    - CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
    - CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
    - CVE-2024-58091: drm/fbdev-dma: Add shadow buffering for deferred I/O (bsc#1240174).
    - CVE-2025-21635: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy (bsc#1236111).
    - CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
    - CVE-2025-21659: netdev: prevent accessing NAPI instances from another namespace (bsc#1236206).
    - CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
    - CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
    - CVE-2025-21701: net: avoid race between device unregistration and ethnl ops (bsc#1237164).
    - CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
    - CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
    - CVE-2025-21706: mptcp: pm: only set fullmesh for subflow endp (bsc#1238528).
    - CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
    - CVE-2025-21717: net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq     (bsc#1238866).
    - CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
    - CVE-2025-21739: kABI: ufshcd: add ufshcd_dealloc_host back (bsc#1238506).
    - CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875).
    - CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
    - CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
    - CVE-2025-21759: ipv6: mcast: extend RCU protection in igmp6_send() (bsc#1238738).
    - CVE-2025-21760: ndisc: extend RCU protection in ndisc_send_skb() (bsc#1238763).
    - CVE-2025-21761: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() (bsc#1238775).
    - CVE-2025-21762: arp: use RCU protection in arp_xmit() (bsc#1238780).
    - CVE-2025-21763: neighbour: use RCU protection in __neigh_notify() (bsc#1237897).
    - CVE-2025-21765: ipv6: use RCU protection in ip6_default_advmss() (bsc#1237906).
    - CVE-2025-21766: ipv4: use RCU protection in __ip_rt_update_pmtu() (bsc#1238754).
    - CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
    - CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
    - CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
    - CVE-2025-21800: net/mlx5: HWS, fix definer's HWS_SET32 macro for negative offset (bsc#1238743).
    - CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
    - CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
    - CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
    - CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
    - CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
    - CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
    - CVE-2025-21837: io_uring/uring_cmd: unconditionally copy SQEs at prep time (bsc#1239064).
    - CVE-2025-21844: smb: client: Add check for next_buffer in receive_encrypted_standard() (bsc#1239512).
    - CVE-2025-21848: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() (bsc#1239479).
    - CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
    - CVE-2025-21856: s390/ism: add release function for struct device (bsc#1239486).
    - CVE-2025-21857: net/sched: cls_api: fix error handling causing NULL dereference (bsc#1239478).
    - CVE-2025-21861: mm/migrate_device: do not add folio to be freed to LRU in migrate_device_finalize()     (bsc#1239483).
    - CVE-2025-21862: drop_monitor: fix incorrect initialization order (bsc#1239474).
    - CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
    - CVE-2025-21864: kABI fix for tcp: drop secpath at the same time as we currently drop (bsc#1239482).
    - CVE-2025-21865: gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl() (bsc#1239481).
    - CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
    - CVE-2025-21870: ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers (bsc#1240191).
    - CVE-2025-21871: tee: optee: Fix supplicant wait loop (bsc#1240183).
    - CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
    - CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
    - CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
    - CVE-2025-21882: net/mlx5: Fix vport QoS cleanup on error (bsc#1240187).
    - CVE-2025-21883: ice: Fix deinitializing VF in error path (bsc#1240189).
    - CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
    - CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
    - CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
    - CVE-2025-21890: idpf: fix checksums set in idpf_rx_rsc() (bsc#1240173).
    - CVE-2025-21891: ipvlan: ensure network headers are in skb linear part (bsc#1240186).
    - CVE-2025-21894: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC (bsc#1240581).
    - CVE-2025-21895: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list (bsc#1240585).
    - CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
    - CVE-2025-21906: wifi: iwlwifi: mvm: clean up ROC on failure (bsc#1240587).
    - CVE-2025-21908: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback (bsc#1240600).
    - CVE-2025-21913: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (bsc#1240591).
    - CVE-2025-21919: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (bsc#1240593).
    - CVE-2025-21922: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639).
    - CVE-2025-21924: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an     error (bsc#1240720).
    - CVE-2025-21925: llc: do not use skb_get() before dev_queue_xmit() (bsc#1240713).
    - CVE-2025-21926: net: gso: fix ownership in __udp_gso_segment (bsc#1240712).
    - CVE-2025-21931: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio (bsc#1240709).
    - CVE-2025-21957: scsi: qla1280: Fix kernel oops when debug level > 2 (bsc#1240742).
    - CVE-2025-21960: eth: bnxt: do not update checksum in bnxt_xdp_build_skb() (bsc#1240815).
    - CVE-2025-21961: eth: bnxt: fix truesize for mb-xdp-pass case (bsc#1240816).
    - CVE-2025-21962: cifs: Fix integer overflow while processing closetimeo mount option (bsc#1240655).
    - CVE-2025-21963: cifs: Fix integer overflow while processing acdirmax mount option (bsc#1240717).
    - CVE-2025-21964: cifs: Fix integer overflow while processing acregmax mount option (bsc#1240740).
    - CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784).
    - CVE-2025-21970: net/mlx5: Bridge, fix the crash caused by LAG state check (bsc#1240819).
    - CVE-2025-21972: net: mctp: unshare packets when reassembling (bsc#1240813).
    - CVE-2025-21973: eth: bnxt: fix kernel panic in the bnxt_get_queue_stats{rx | tx} (bsc#1240803).
    - CVE-2025-21974: eth: bnxt: return fail if interface is down in bnxt_queue_mem_alloc() (bsc#1240800).
    - CVE-2025-21975: net/mlx5: handle errors in mlx5_chains_create_table() (bsc#1240812).
    - CVE-2025-21980: sched: address a potential NULL pointer dereference in the GRED scheduler (bsc#1240809).
    - CVE-2025-21981: ice: fix memory leak in aRFS after reset (bsc#1240612).
    - CVE-2025-21985: drm/amd/display: Fix out-of-bound accesses (bsc#1240811).
    - CVE-2025-21991: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (bsc#1240795).
    - CVE-2025-21993: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (bsc#1240797).
    - CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
    - CVE-2025-22015: mm/migrate: fix shmem xarray update during migration (bsc#1240944).
    - CVE-2025-22016: dpll: fix xa_alloc_cyclic() error handling (bsc#1240934).
    - CVE-2025-22017: devlink: fix xa_alloc_cyclic() error handling (bsc#1240936).
    - CVE-2025-22018: atm: Fix NULL pointer dereference (bsc#1241266).
    - CVE-2025-22021: netfilter: socket: Lookup orig tuple for IPv6 SNAT (bsc#1241282).
    - CVE-2025-22030: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (bsc#1241376).
    - CVE-2025-22036: exfat: fix random stack corruption after get_block (bsc#1241426).
    - CVE-2025-22045: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (bsc#1241433).
    - CVE-2025-22053: net: ibmveth: make veth_pool_store stop hanging (bsc#1241373).
    - CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
    - CVE-2025-22057: net: decrease cached dst counters in dst_release (bsc#1241533).
    - CVE-2025-22058: udp: Fix memory accounting leak (bsc#1241332).
    - CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
    - CVE-2025-22063: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (bsc#1241351).
    - CVE-2025-22064: netfilter: nf_tables: do not unregister hook when table is dormant (bsc#1241413).
    - CVE-2025-22070: fs/9p: fix NULL pointer dereference on mkdir (bsc#1241305).
    - CVE-2025-22080: fs/ntfs3: Prevent integer overflow in hdr_first_de() (bsc#1241416).
    - CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
    - CVE-2025-22094: powerpc/perf: Fix ref-counting on the PMU 'vpa_pmu' (bsc#1241512).
    - CVE-2025-22102: Bluetooth: btnxpuart: Fix kernel panic during FW release (bsc#1241456).
    - CVE-2025-22103: net: fix NULL pointer dereference in l3mdev_l3_rcv (bsc#1241448).
    - CVE-2025-22104: ibmvnic: Use kernel helpers for hex dumps (bsc#1241550).
    - CVE-2025-22105, CVE-2025-37860: Add missing bugzilla references (bsc#1241452 bsc#1241548).
    - CVE-2025-22107: net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry()     (bsc#1241575).
    - CVE-2025-22109: ax25: Remove broken autobind (bsc#1241573).
    - CVE-2025-22121: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (bsc#1241593).
    - CVE-2025-2312: CIFS: New mount option for cifs.upcall namespace resolution (bsc#1239684).
    - CVE-2025-23133: wifi: ath11k: update channel list in reg notifier instead reg worker (bsc#1241451).
    - CVE-2025-23138: watch_queue: fix pipe accounting mismatch (bsc#1241648).
    - CVE-2025-23140: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error     (bsc#1242763).
    - CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
    - CVE-2025-23150: ext4: fix off-by-one error in do_split (bsc#1242513).
    - CVE-2025-23154: io_uring/net: fix io_req_post_cqe abuse by send bundle (bsc#1242533).
    - CVE-2025-23160: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW     initialization (bsc#1242507).
    - CVE-2025-37747: kABI workaround for perf-Fix-hang-while-freeing-sigtrap-event (References: bsc#1242520).
    - CVE-2025-37748: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (bsc#1242523).
    - CVE-2025-37749: net: ppp: Add bound checking for skb data on ppp_sync_txmung (bsc#1242859).
    - CVE-2025-37750: smb: client: fix UAF in decryption with multichannel (bsc#1242510).
    - CVE-2025-37755: net: libwx: handle page_pool_dev_alloc_pages error (bsc#1242506).
    - CVE-2025-37773: virtiofs: add filesystem context source name check (bsc#1242502).
    - CVE-2025-37780: isofs: Prevent the use of too small fid (bsc#1242786).
    - CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).
    - CVE-2025-37787: net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered     (bsc#1242585).
    - CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
    - CVE-2025-37790: net: mctp: Set SOCK_RCU_FREE (bsc#1242509).
    - CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
    - CVE-2025-37798: codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (bsc#1242414).
    - CVE-2025-37799: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (bsc#1242283).
    - CVE-2025-37803: udmabuf: fix a buf size overflow issue during udmabuf creation (bsc#1242852).
    - CVE-2025-37804: io_uring: always do atomic put from iowq (bsc#1242854).
    - CVE-2025-37809: usb: typec: class: Unlocked on error in typec_register_partner() (bsc#1242856).
    - CVE-2025-37820: xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (bsc#1242866).
    - CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
    - CVE-2025-37824: tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (bsc#1242867).
    - CVE-2025-37829: cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (bsc#1242875).
    - CVE-2025-37830: cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (bsc#1242860).
    - CVE-2025-37831: cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (bsc#1242861).
    - CVE-2025-37833: net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (bsc#1242868).
    - CVE-2025-37842: spi: fsl-qspi: Fix double cleanup in probe error path (bsc#1242951).
    - CVE-2025-37870: drm/amd/display: prevent hang on link training fail (bsc#1243056).
    - CVE-2025-37879: 9p/net: fix improper handling of bogus negative read/write replies (bsc#1243077).
    - CVE-2025-37886: pds_core: make wait_context part of q_info (bsc#1242944).
    - CVE-2025-37887: pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result (bsc#1242962).
    - CVE-2025-37949: xenbus: Use kref to track req lifetime (bsc#1243541).
    - CVE-2025-37957: KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (bsc#1243513).
    - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539).
    - CVE-2025-37960: memblock: Accept allocated memory before use in memblock_double_array() (bsc#1243519).
    - CVE-2025-37974: s390/pci: Fix missing check for zpci_create_device() error return (bsc#1243547).
    - CVE-2025-38152: remoteproc: core: Clear table_sz when rproc_shutdown (bsc#1241627).
    - CVE-2025-38637: net_sched: skbprio: Remove overly strict queue assertions (bsc#1241657).
    - CVE-2025-39728: clk: samsung: Fix UBSAN panic in samsung_clk_init() (bsc#1241626).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
303468	Oracle Linux 10 / 9：Unbreakable Enterprise 核心 (ELSA-2026-50160)	Nessus	Oracle Linux Local Security Checks	2026/3/24	2026/3/24	critical
303468	Oracle Linux 10 / 9：Unbreakable Enterprise 内核 (ELSA-2026-50160)	Nessus	Oracle Linux Local Security Checks	2026/3/24	2026/3/24	critical
306779	Oracle Linux 10 / 9：Unbreakable Enterprise 内核 (ELSA-2026-50232)	Nessus	Oracle Linux Local Security Checks	2026/4/16	2026/5/6	critical
306779	Oracle Linux 10 / 9：Unbreakable Enterprise 核心 (ELSA-2026-50232)	Nessus	Oracle Linux Local Security Checks	2026/4/16	2026/5/6	critical
244259	Linux Distros 未修補的弱點：CVE-2025-21717	Nessus	Misc.	2025/8/6	2025/8/6	medium
244259	Linux Distros 未修补的漏洞：CVE-2025-21717	Nessus	Misc.	2025/8/6	2025/8/6	medium
303468	Oracle Linux 10 / 9 : Unbreakable Enterprise カーネル (ELSA-2026-50160)	Nessus	Oracle Linux Local Security Checks	2026/3/24	2026/3/24	critical
306779	Oracle Linux 10 / 9 : Unbreakable Enterprise カーネル (ELSA-2026-50232)	Nessus	Oracle Linux Local Security Checks	2026/4/16	2026/5/6	critical
244259	Linux Distros のパッチ未適用の脆弱性: CVE-2025-21717	Nessus	Misc.	2025/8/6	2025/8/6	medium
240801	SUSE SLES15 セキュリティ更新 : kernel (SUSE-SU-2025:01967-1)	Nessus	SuSE Local Security Checks	2025/6/27	2025/9/24	medium
240805	SUSE SLED15 / SLES15 セキュリティ更新 : kernel (SUSE-SU-2025:01951-1)	Nessus	SuSE Local Security Checks	2025/6/27	2025/9/24	medium
244259	Linux Distros Unpatched Vulnerability : CVE-2025-21717	Nessus	Misc.	2025/8/6	2025/8/6	medium
303468	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50160)	Nessus	Oracle Linux Local Security Checks	2026/3/24	2026/3/24	critical
306779	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50232)	Nessus	Oracle Linux Local Security Checks	2026/4/16	2026/5/6	critical
240801	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:01967-1)	Nessus	SuSE Local Security Checks	2025/6/27	2025/9/24	medium
240805	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2025:01951-1)	Nessus	SuSE Local Security Checks	2025/6/27	2025/9/24	medium

检测

插件搜索

critical

critical

critical

critical

medium

medium

critical

critical

medium

medium

medium

medium

critical

critical

medium

medium