远程 Oracle Linux 10 / 9 主机上安装的多个程序包受到 ELSA-2026-50160 公告中提及的多个漏洞影响。

    - mm/hugetlb：修复 hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
    - platform/x86：classmate-laptop：添加缺失的空指针检查 (Rafael J. Wysocki) [Orabug: 39044501] {CVE-2026-23237}
    - scsi：qla2xxx：修复造成双重释放的 bsg_done() (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
    - wifi：rtl8xxxu：修复 rtl8xxxu_sta_add 中的 slab 越界 (Ali Tariq) [Orabug: 38997990] {CVE-2025-71234}
    - xfs：修复 xchk_btree_check_block_owner 中的 UAF (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
    - scsi：qla2xxx：释放错误路径中的 sp 以修复系统崩溃 (Anil Gurumurthy) [Orabug: 38997979] {CVE-2025-71232}
    - scsi：qla2xxx：在结构扫描进行期间延迟模块卸载 (Anil Gurumurthy) [Orabug: 38997992] {CVE-2025-71235}
    - scsi：qla2xxx：在释放相关内存之前验证 sp (Anil Gurumurthy) [Orabug: 38997998] {CVE-2025-71236}
    - wifi：rtw88：修复 rtw_core_enable_beacon() 中的对齐错误 (Bitterblue Smith) [Orabug: 38997972] {CVE-2025-71229}
    - crypto：virtio - 为 virtqueue 通知添加旋锁保护 (Bibo Mao) [Orabug: 38998052] {CVE-2026-23229}
    - crypto：iaa - 修复 find_empty_iaa_compression_mode 中的越界索引 (Thorsten Blum) [Orabug：
    38997976] {CVE-2025-71231}
    - smb：client：拆分 cached_fid 位字段以避免共享字节 RMW 争用 (Henrique Carvalho) [Orabug：
    38998059] {CVE-2026-23230}
    - spi：tegra210-quad：保护 tegra_qspi_combined_seq_xfer 中的 curr_xfer (Breno Leitao) [Orabug: 38970593] {CVE-2026-23202}
    - ASoC：amd：修复 acp3x pdm dma ops 中的内存泄漏 (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
    - ipv6：修复清除 RTF_ADDRCONF 时的 ECMP 同级计数不匹配 (Shigeru Yoshida) [Orabug: 38970598] {CVE-2026-23200}
    - netfilter：nf_tables：修复 nft_map_catchall_activate() 中的反向 genmask 检查 (Andrew Fasano) [Orabug：
    38970170] {CVE-2026-23111}
    - net: usb: r8152：修复恢复重置死锁 (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
    - macvlan：修复 macvlan_common_newlink() 中的错误恢复 (Eric Dumazet) [Orabug: 38970508] {CVE-2026-23209}
    - net/sched：cls_u32：使用 skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
    - smb/client：修复 smb2_open_file() 中的内存泄漏 (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
    - btrfs：如果 fs 完全只读，则拒绝新的事务 (Qu Wenruo) [Orabug: 38985156] {CVE-2026-23214}
    - scsi：target：iscsi：修复 iscsit_dec_conn_usage_count() 中的释放后使用 (Maurizio Lombardi) [Orabug：
    38985169] {CVE-2026-23216}
    - scsi：target：iscsi：修复 iscsit_dec_session_usage_count() 中的释放后使用 (Maurizio Lombardi) [Orabug：
    38970453] {CVE-2026-23193}
    - nvmet-tcp：修复 nvmet_tcp_listen_data_ready() 中的挂起 (Hannes Reinecke) [Orabug: 38970416] {CVE-2026-23179}
    - drm/amd/pm：在 SMU 模式 1 重置期间禁用 MMIO 访问 (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
    - HID：i2c-hid：修复 i2c_hid_get_report() 中的潜在缓冲区溢出 (Kwok Kin Ming) [Orabug: 38970413] {CVE-2026-23178}
    - md：通过 sysfs 更新 raid_disks 时暂停数组 (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
    - wifi：wlcore：在 skb_push 前确保 skb 余量 (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
    - wifi：mac80211：ocb：未加入接口时，跳过 rx_no_sta (Moon Hee Lee) [Orabug: 38970163] {CVE-2025-71224}
    - procfs：避免在保持 VMA 锁定时获取版本 ID (Andrii Nakryiko) [Orabug: 38970476] {CVE-2026-23199}
    - mm, shmem：防止截断争用时无限循环 (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
    - ceph：修复由于 parse_longname() 中 kfree() 的指针无效而导致的 oops (Daniel Vogelbacher) [Orabug：
    38970590] {CVE-2026-23201}
    - ceph：修复 ceph_mds_auth_match() 中的空指针取消引用 (Viacheslav Dubeyko) [Orabug: 38970595] {CVE-2026-23189}
    - mm/slab：添加 memcg_alloc_abort_single 的 alloc_tagging_slab_free_hook (Hao Ge) [Orabug: 38985192] {CVE-2026-23219}
    - ALSA：aloop：修复 PCM 触发时的 racy 访问 (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
    - x86/vmware：修复超级调用破坏 (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
    - nvmet-tcp：在 nvmet_tcp_build_pdu_iovec 中添加边界检查 (Yunje Shin) [Orabug: 38970176] {CVE-2026-23112}
    - perf：sched：使用新的 is_user_task() 帮助程序修复 perf 崩溃 (Steven Rostedt) [Orabug: 38970581] {CVE-2026-23159}
    - wifi：ath11k：在监控模式下，为 ath11k_hal_srng_* 添加 srng->lock (Kang Yang) [Orabug: 37844126] {CVE-2024-58096}
    - drm/amdgpu：修复 amdgpu_gmc_filter_faults_remove 中的空指针取消引用 (Jon Doron) [Orabug：
    38970348] {CVE-2026-23163}
    - net：修复转发 fraglist GRO 的分段 (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
    - mm/shmem，swap：修复截断和交换条目拆分的争用 (Kairui Song) [Orabug: 38970345] {CVE-2026-23161}
    - flex_proportions：使 fprop_new_period() 在硬中断上下文中安全 (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
    - nvmet：修复 nvmet_bio_done() 中导致空指针取消引用的争用 (Ming Lei) [Orabug: 38970608] {CVE-2026-23148}
    - efivarfs：修复 efivar_entry_get() 中的错误传播 (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
    - net/mlx5e：TC，仅删除现有对等机的流 (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
    - ice：修复 ice_vsi_set_napi_queues 中的空指针取消引用 (Aaron Ma) [Orabug: 38970364] {CVE-2026-23166}
    - rocker：修复 rocker_world_port_post_fini() 中的内存泄漏 (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
    - bonding：针对围绕 slave->last_rx 的数据争用添加注释 (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
    - Bluetooth：MGMT：修复 set_ssp_complete 中的内存泄漏 (Jianpeng Chang) [Orabug: 38970587] {CVE-2026-23151}
    - Bluetooth：hci_uart：修复 hci_uart_write_work 中的 null-ptr-deref (Jia-Hong Su) [Orabug: 38970604] {CVE-2026-23146}
    - wifi：ath11k：修复在回收监控目标环形缓冲区时发生的 RCU 停滞 (P Praneesh) [Orabug: 37844129] {CVE-2024-58097}
    - btrfs：修复 btrfs_clear_space_info_full() 中的 racy 位域写入 (Boris Burkov) [Orabug: 38798802] {CVE-2025-68358}
    - sched_ext：修复 deferred_irq_workfn() 中可能的死锁 (Zqiang) [Orabug: 38792605] {CVE-2025-68333}
    - exfat：修复 exfat_find 中的 refcount 泄漏 (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
    - bpf：禁止 BPF 测试基础设施向网络协议栈发出无效的 GSO 类型 (Daniel Borkmann) [Orabug: 38798881] {CVE-2025-68725}
    - migrate：更正 hugetlb 文件作品集的锁定顺序 (Matthew Wilcox) [Orabug: 38931066] {CVE-2026-23097}
    - can：usb_8dev: usb_8dev_read_bulk_callback()：修复 URB 内存泄漏 (Marc Kleine-Budde) [Orabug: 38931120] {CVE-2026-23108}
    - can：kvaser_usb：kvaser_usb_read_bulk_callback()：修复 URB 内存泄漏 (Marc Kleine-Budde) [Orabug: 
    38930881] {CVE-2026-23061}
    - can：ems_usb：ems_usb_read_bulk_callback()：修复 URB 内存泄漏 (Marc Kleine-Budde) [Orabug: 38930859] {CVE-2026-23058}
    - irqchip/gic-v3-its：避免截断内存地址 (Arnd Bergmann) [Orabug: 38931001] {CVE-2026-23085}
    - intel_th：修复输出 open() 上的设备泄漏 (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
    - tracing：修复在使用合成堆栈跟踪字段时出现的崩溃问题 (Steven Rostedt) [Orabug: 38931024] {CVE-2026-23088}
    - arm64：在 swsusp_arch_resume() 上设置 __nocfi (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
    - arm64/fpsimd: signal：还原 ZA 时分配 SSVE 存储 (Mark Rutland) [Orabug: 38931118] {CVE-2026-23107}
    - wifi：rsi：修复因未设置 vif 驱动程序数据大小而导致的内存损坏 (Marek Vasut) [Orabug: 38930939] {CVE-2026-23073}
    - wifi：ath10k：修复 dma_free_coherent() 指针 (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
    - ALSA：usb-audio：修复 snd_usb_mixer_free() 中的释放后使用 (Berk Cem Goksel) [Orabug: 38931029] {CVE-2026-23089}
    - ALSA：scarlett2：修复配置检索中的缓冲区溢出 (Samasth Norway Ananda) [Orabug: 38930973] {CVE-2026-23078}
    - ALSA：ctxfi：修复音频混合器处理中潜在的 OOB 访问 (Takashi Iwai) [Orabug: 38930966] {CVE-2026-23076}
    - leds：led-class：仅在完全准备就绪时将 LED 添加到 leds_list (Hans de Goede) [Orabug: 38931091] {CVE-2026-23101}
    - dpll：防止重复注册 (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
    - vsock/virtio：将 TX credit 限制为本地缓冲区大小 (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
    - vsock/virtio：修复 virtio_transport_get_credit() 中潜在的下溢 (Melbin K Mathew) [Orabug：
    38930919] {CVE-2026-23069}
    - bonding：提供指向 __skb_flow_dissect() 的网络指针 (Eric Dumazet) [Orabug: 38970199] {CVE-2026-23119}
    - be2net：修复 be_cmd_get_mac_from_list 中的空指针取消引用 (Andrey Vatoropin) [Orabug: 38930992] {CVE-2026-23084}
    - ipv6：为 ndisc_router_discovery() 中的数据争用添加注释 (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
    - netdevsim：修复与 bpf_bound_progs 列表操作相关的争用问题 (Yun Lu) [Orabug: 38970233] {CVE-2026-23126}
    - scsi：qla2xxx：审查负载大小以防止成员溢出 (Jiasheng Jiang) [Orabug: 38930867] {CVE-2026-23059}
    - scsi：core：最终完成之间相互争用时唤醒错误处理程序 (David Jeffery) [Orabug: 38931132] {CVE-2026-23110}
    - regmap：修复 hwspinlock irqsave 例程中的争用条件 (Cheng-Yu Lee) [Orabug: 38930930] {CVE-2026-23071}
    - interconnect：debugfs：将 src_node 和 dst_node 初始化为空字符串 (Georgi Djakov) [Orabug：
    38970218] {CVE-2026-23123}
    - io_uring/io-wq：检查工作运行循环内部的 IO_WQ_BIT_EXIT (Jens Axboe) [Orabug: 38970181] {CVE-2026-23113}
    - platform/x86：hp-bioscfg：修复 GET_INSTANCE_ID 宏中的内核错误 (Mario Limonciello) [Orabug：
    38930890] {CVE-2026-23062}
    - platform/x86：hp-bioscfg：修复空属性名称的 kobject 警告 (Mario Limonciello) [Orabug：
    38970247] {CVE-2026-23131}
    - scsi：xen：scsiback：修复 scsiback_remove() 中的潜在内存泄漏 (Abdun Nihaal) [Orabug: 38931014] {CVE-2026-23087}
    - w1：therm：修复 alarms_store 中的差一缓冲区溢出 (Thorsten Blum) [Orabug: 38930796] {CVE-2025-71197}
    - crypto：authencesn - 拒绝不符合 ESP/ESN 规范的过短 AAD (assoclen<8) (Taeyang Lee) [Orabug：
    38930874] {CVE-2026-23060}
    - net/sched: qfq：使用 cl_is_active 确定类在 qfq_rm_from_ag 中是否活动 (Jamal Hadi Salim) [Orabug: 38931110] {CVE-2026-23105}
    - net/sched：强制 teql 只能用作根 qdisc (Jamal Hadi Salim) [Orabug: 38930948] {CVE-2026-23074}
    - ipvlan：按端口设置 addrs_lock (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
    - l2tp：避免 l2tp_tunnel_del_work() 中的数据争用 (Eric Dumazet) [Orabug：38970202] {CVE-2026-23120}
    - gue：修复内部 IP 协议 0 的 skb 内存泄露。(Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
    - sctp：在 SCTP_CMD_PEER_INIT 之后移动 SCTP_CMD_ASSOC_SHKEY (Xin Long) [Orabug: 38970225] {CVE-2026-23125}
    - can：gs_usb：gs_usb_receive_bulk_callback()：usb_submit_urb() 错误中的非定位 URL (Marc Kleine-Budde) [Orabug: 38931184] {CVE-2026-23082}
    - l2tp：修复 l2tp_udp_encap_recv() 中的内存泄漏。(Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
    - bonding：将 BOND_MODE_8023AD 限制为以太网设备 (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
    - vsock/virtio：仅合并线性的 skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}

Tenable 已直接从 Oracle Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - nilfs2修复 可能造成系统挂起的块溢出 用户执行 FITRIM 命令时如果 end_block 太小则在计算 nblocks 时可能发生下溢。由于 nblocks 的类型为ector_t即 u64负的 nblocks 值将变成一个非常大的正整数。这最终导致区块层函数 __blkdev_issue_discard() 花费过长的时间来处理 bio 链并且 ns_segctor_sem 锁定长时间保持保持状态。这会阻止其他任务获取 ns_segctor_sem 锁定从而导致 [1] 中的 syzbot 报告的挂起。如果结束块太小通常小于 4KiB 范围根据段 0 的使用情况可能尝试丢弃超出设备大小的请求从而导致挂起。成功退出并将丢弃的大小（在本例中为 0）分配给 range->len。虽然用户输入范围中的 start 和 len 值过小但此处采用保守策略可以安全地忽略它们这等同于 no-op它不会执行任何裁剪也不会抛出错误。 [1] task:segctord state:D stack:28968 pid:6093 tgid:6093 ppid:2 task_flags:0x200040 flags:0x00080000 调用跟踪
    rwbase_write_lock+0x3dd/0x750 kernel/locking/rwbase_rt.c:272 nilfs_transaction_lock+0x253/0x4c0 fs/nilfs2/segment.c:357 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2569 [内联] nilfs_segctor_thread+0x6ec/0xe020 fs/nlfs20 segment.c:2684 [ryusuke已修正关于后果的部分提交消息] (CVE-2025-71237)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

远程主机上安装的内核版本低于 5.10.251-248.983。因此，会受到 ALAS2KERNEL-5.10-2026-114 公告中提及的多个漏洞影响。

    在 Linux 内核中，以下漏洞已修复：

    HIDuclogic修正 hidinput input_dev 名称的 devm 设备引用 (CVE-2023-54207)

    在 Linux 内核中，以下漏洞已修复：

    driver 核心修复 device_add() 中潜在的 null-ptr-deref (CVE-2023-54321)

    在 Linux 内核中，以下漏洞已修复：

    bpf拒绝对指针 ctx 字段更窄的访问权限 (CVE-2025-38591)

    在 Linux 内核中，以下漏洞已修复：

    ksm使用 range-walk 函数跳过 scan_get_next_rmap_item 中的漏洞 (CVE-2025-68211)

    在 Linux 内核中，以下漏洞已修复：

    bpf不要让 BPF 测试基础设施向堆栈发出无效 GSO 类型CVE-2025-68725]

    在 Linux 内核中，以下漏洞已修复：

    btrfs修复 wait_current_trans() 中由于忽略事务类型导致的死锁 (CVE-2025-71194)

    在 Linux 内核中，以下漏洞已修复：scsi: qla2xxx: Free sp in error path to fix system crash System crash seen during load/unload test in a loop, [61110.449331] qla2xxx [0000:27:00.0]-0042:0: Disabled MSI-X. [61110.467494] ============================================================================= [61110.467498] BUG qla2xxx_srbs (Tainted: G OE -------- --- ): Objects remaining in qla2xxx_srbs on __kmem_cache_shutdown() [61110.467501] ----------------------------------------------------------------------------- [61110.467502] Slab 0x000000000ffc8162 objects=51 used=1 fp=0x00000000e25d3d85 flags=0x57ffffc0010200(slab|head|node=1|zone=2|lastcpupid=0x1fffff) [61110.467509] CPU: 53 PID: 455206 Comm: rmmod Kdump: loaded Tainted: G OE -------- --- 5.14.0-284.11.1.el9_2.x86_64 #1 [61110.467513] Hardware name: HPE ProLiant DL385 Gen10 Plus v2/ProLiant DL385 Gen10 Plus v2, BIOS A42 08/17/2023 [61110.467515] Call Trace: [61110.467516] <TASK> [61110.467519] dump_stack_lvl+0x34/0x48 [61110.467526] slab_err.cold+0x53/0x67 [61110.467534] __kmem_cache_shutdown+0x16e/0x320 [61110.467540] kmem_cache_destroy+0x51/0x160 [61110.467544] qla2x00_module_exit+0x93/0x99 [qla2xxx] [61110.467607] ?
    __do_sys_delete_module.constprop.0+0x178/0x280 [61110.467613] ? syscall_trace_enter.constprop.0+0x145/0x1d0 [61110.467616] ? do_syscall_64+0x5c/0x90 [61110.467619] ? exc_page_fault+0x62/0x150 [61110.467622] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd [61110.467626] </TASK> [61110.467627] Disabling lock debugging due to kernel taint [61110.467635] Object 0x0000000026f7e6e6 @offset=16000 [61110.467639] ------------[ cut here ]------------ [61110.467639] kmem_cache_destroy qla2xxx_srbs: Slab cache still has objects when called from qla2x00_module_exit+0x93/0x99 [qla2xxx] [61110.467659] WARNING: CPU: 53 PID: 455206 at mm/slab_common.c:520 kmem_cache_destroy+0x14d/0x160 [61110.467718] CPU: 53 PID: 455206 Comm: rmmod Kdump: loaded Tainted: G B OE -------- --- 5.14.0-284.11.1.el9_2.x86_64 #1 [61110.467720] Hardware name: HPE ProLiant DL385 Gen10 Plus v2/ProLiant DL385 Gen10 Plus v2, BIOS A42 08/17/2023 [61110.467721] RIP: 0010:kmem_cache_destroy+0x14d/0x160 [61110.467724] Code: 99 7d 07 00 48 89 ef e8 e1 6a 07 00 eb b3 48 8b 55 60 48 8b 4c 24 20 48 c7 c6 70 fc 66 90 48 c7 c7 f8 ef a1 90 e8 e1 ed 7c 00 <0f> 0b eb 93 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 [61110.467725] RSP: 0018:ffffa304e489fe80 EFLAGS: 00010282 [61110.467727] RAX: 0000000000000000 RBX:
    ffffffffc0d9a860 RCX: 0000000000000027 [61110.467729] RDX: ffff8fd5ff9598a8 RSI: 0000000000000001 RDI:
    ffff8fd5ff9598a0 [61110.467730] RBP: ffff8fb6aaf78700 R08: 0000000000000000 R09: 0000000100d863b7 [61110.467731] R10: ffffa304e489fd20 R11: ffffffff913bef48 R12: 0000000040002000 [61110.467731] R13:
    0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [61110.467733] FS: 00007f64c89fb740(0000) GS:ffff8fd5ff940000(0000) knlGS:0000000000000000 [61110.467734] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [61110.467735] CR2: 00007f0f02bfe000 CR3: 00000020ad6dc005 CR4: 0000000000770ee0 [61110.467736] PKRU: 55555554 [61110.467737] Call Trace: [61110.467738] <TASK> [61110.467739] qla2x00_module_exit+0x93/0x99 [qla2xxx] [61110.467755] ? __do_sys_delete_module.constprop.0+0x178/0x280 Free sp in the error path to fix the crash. (CVE-2025-71232)

    在 Linux 内核中，以下漏洞已修复：scsi: qla2xxx: Delay module unload while fabric scan in progress System crash seen during load/unload test in a loop. [105954.384919] RBP:
    ffff914589838dc0 R08: 0000000000000000 R09: 0000000000000086 [105954.384920] R10: 000000000000000f R11:
    ffffa31240904be5 R12: ffff914605f868e0 [105954.384921] R13: ffff914605f86910 R14: 0000000000008010 R15:
    00000000ddb7c000 [105954.384923] FS: 0000000000000000(0000) GS:ffff9163fec40000(0000) knlGS:0000000000000000 [105954.384925] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [105954.384926] CR2: 000055d31ce1d6a0 CR3: 0000000119f5e001 CR4: 0000000000770ee0 [105954.384928] PKRU: 55555554 [105954.384929] Call Trace: [105954.384931] <IRQ> [105954.384934] qla24xx_sp_unmap+0x1f3/0x2a0 [qla2xxx] [105954.384962] ? qla_async_scan_sp_done+0x114/0x1f0 [qla2xxx] [105954.384980] ? qla24xx_els_ct_entry+0x4de/0x760 [qla2xxx] [105954.384999] ? __wake_up_common+0x80/0x190 [105954.385004] ? qla24xx_process_response_queue+0xc2/0xaa0 [qla2xxx] [105954.385023] ? qla24xx_msix_rsp_q+0x44/0xb0 [qla2xxx] [105954.385040] ? __handle_irq_event_percpu+0x3d/0x190 [105954.385044] ? handle_irq_event+0x58/0xb0 [105954.385046] ? handle_edge_irq+0x93/0x240 [105954.385050] ?
    __common_interrupt+0x41/0xa0 [105954.385055] ? common_interrupt+0x3e/0xa0 [105954.385060] ? asm_common_interrupt+0x22/0x40 The root cause of this was that there was a free (dma_free_attrs) in the interrupt context. There was a device discovery/fabric scan in progress. A module unload was issued which set the UNLOADING flag. As part of the discovery, after receiving an interrupt a work queue was scheduled (which involved a work to be queued). Since the UNLOADING flag is set, the work item was not allocated and the mapped memory had to be freed. The free occurred in interrupt context leading to system crash. Delay the driver unload until the fabric scan is complete to avoid the crash. (CVE-2025-71235)

    在 Linux 内核中，以下漏洞已修复：scsi: qla2xxx: Validate sp before freeing associated memory System crash with the following signature [154563.214890] nvme nvme2: NVME-FC{1}: controller connect complete [154564.169363] qla2xxx [0000:b0:00.1]-3002:2: nvme: Sched: Set ZIO exchange threshold to 3. [154564.169405] qla2xxx [0000:b0:00.1]-ffffff:2: SET ZIO Activity exchange threshold to 5. [154565.539974] qla2xxx [0000:b0:00.1]-5013:2: RSCN database changed - 0078 0080 0000.
    [154565.545744] qla2xxx [0000:b0:00.1]-5013:2: RSCN database changed - 0078 00a0 0000. [154565.545857] qla2xxx [0000:b0:00.1]-11a2:2: FEC=enabled (data rate). [154565.552760] qla2xxx [0000:b0:00.1]-11a2:2:
    FEC=enabled (data rate). [154565.553079] BUG: kernel NULL pointer dereference, address: 00000000000000f8 [154565.553080] #PF: supervisor read access in kernel mode [154565.553082] #PF: error_code(0x0000) - not-present page [154565.553084] PGD 80000010488ab067 P4D 80000010488ab067 PUD 104978a067 PMD 0 [154565.553089] Oops: 0000 1 PREEMPT SMP PTI [154565.553092] CPU: 10 PID: 858 Comm: qla2xxx_2_dpc Kdump:
    loaded Tainted: G OE ------- --- 5.14.0-503.11.1.el9_5.x86_64 #1 [154565.553096] Hardware name: HPE Synergy 660 Gen10/Synergy 660 Gen10 Compute Module, BIOS I43 09/30/2024 [154565.553097] RIP:
    0010:qla_fab_async_scan.part.0+0x40b/0x870 [qla2xxx] [154565.553141] Code: 00 00 e8 58 a3 ec d4 49 89 e9 ba 12 20 00 00 4c 89 e6 49 c7 c0 00 ee a8 c0 48 c7 c1 66 c0 a9 c0 bf 00 80 00 10 e8 15 69 00 00 <4c> 8b 8d f8 00 00 00 4d 85 c9 74 35 49 8b 84 24 00 19 00 00 48 8b [154565.553143] RSP: 0018:ffffb4dbc8aebdd0 EFLAGS: 00010286 [154565.553145] RAX: 0000000000000000 RBX: ffff8ec2cf0908d0 RCX: 0000000000000002 [154565.553147] RDX: 0000000000000000 RSI: ffffffffc0a9c896 RDI: ffffb4dbc8aebd47 [154565.553148] RBP:
    0000000000000000 R08: ffffb4dbc8aebd45 R09: 0000000000ffff0a [154565.553150] R10: 0000000000000000 R11:
    000000000000000f R12: ffff8ec2cf0908d0 [154565.553151] R13: ffff8ec2cf090900 R14: 0000000000000102 R15:
    ffff8ec2cf084000 [154565.553152] FS: 0000000000000000(0000) GS:ffff8ed27f800000(0000) knlGS:0000000000000000 [154565.553154] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [154565.553155] CR2: 00000000000000f8 CR3: 000000113ae0a005 CR4: 00000000007706f0 [154565.553157] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [154565.553158] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [154565.553159] PKRU: 55555554 [154565.553160] Call Trace: [154565.553162] <TASK> [154565.553165] ? show_trace_log_lvl+0x1c4/0x2df [154565.553172] ? show_trace_log_lvl+0x1c4/0x2df [154565.553177] ? qla_fab_async_scan.part.0+0x40b/0x870 [qla2xxx] [154565.553215] ?
    __die_body.cold+0x8/0xd [154565.553218] ? page_fault_oops+0x134/0x170 [154565.553223] ? snprintf+0x49/0x70 [154565.553229] ? exc_page_fault+0x62/0x150 [154565.553238] ? asm_exc_page_fault+0x22/0x30 Check for sp being non NULL before freeing any associated memory (CVE-2025-71236)

    在 Linux 内核中，以下漏洞已修复：nilfs2: Fix potential block overflow that cause system hang When a user executes the FITRIM command, an underflow can occur when calculating nblocks if end_block is too small. Since nblocks is of type sector_t, which is u64, a negative nblocks value will become a very large positive integer. This ultimately leads to the block layer function
    __blkdev_issue_discard() taking an excessively long time to process the bio chain, and the ns_segctor_sem lock remains held for a long period. This prevents other tasks from acquiring the ns_segctor_sem lock, resulting in the hang reported by syzbot in [1]. If the ending block is too small, typically if it is smaller than 4KiB range, depending on the usage of the segment 0, it may be possible to attempt a discard request beyond the device size causing the hang. Exiting successfully and assign the discarded size (0 in this case) to range->len. Although the start and len values in the user input range are too small, a conservative strategy is adopted here to safely ignore them, which is equivalent to a no-op; it will not perform any trimming and will not throw an error. [1] task:segctord state:D stack:28968 pid:6093 tgid:6093 ppid:2 task_flags:0x200040 flags:0x00080000 Call Trace: rwbase_write_lock+0x3dd/0x750 kernel/locking/rwbase_rt.c:272 nilfs_transaction_lock+0x253/0x4c0 fs/nilfs2/segment.c:357 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2569 [inline] nilfs_segctor_thread+0x6ec/0xe00 fs/nilfs2/segment.c:2684 [ryusuke: corrected part of the commit message about the consequences] (CVE-2025-71237)

    在 Linux 内核中，以下漏洞已修复：scsi: qla2xxx: Fix bsg_done() causing double free Kernel panic observed on system, [5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000 [5353358.825194] #PF: supervisor write access in kernel mode [5353358.825195] #PF: error_code(0x0002) - not-present page [5353358.825196] PGD 100006067 P4D 0 [5353358.825198] Oops:
    0002 [#1] PREEMPT SMP NOPTI [5353358.825200] CPU: 5 PID: 2132085 Comm: qlafwupdate.sub Kdump: loaded Tainted: G W L ------- --- 5.14.0-503.34.1.el9_5.x86_64 #1 [5353358.825203] Hardware name: HPE ProLiant DL360 Gen11/ProLiant DL360 Gen11, BIOS 2.44 01/17/2025 [5353358.825204] RIP: 0010:memcpy_erms+0x6/0x10 [5353358.825211] RSP: 0018:ff591da8f4f6b710 EFLAGS: 00010246 [5353358.825212] RAX: ff5f5e897b024000 RBX:
    0000000000007090 RCX: 0000000000001000 [5353358.825213] RDX: 0000000000001000 RSI: ff591da8f4fed090 RDI:
    ff5f5e897b024000 [5353358.825214] RBP: 0000000000010000 R08: ff5f5e897b024000 R09: 0000000000000000 [5353358.825215] R10: ff46cf8c40517000 R11: 0000000000000001 R12: 0000000000008090 [5353358.825216] R13:
    ff591da8f4f6b720 R14: 0000000000001000 R15: 0000000000000000 [5353358.825218] FS: 00007f1e88d47740(0000) GS:ff46cf935f940000(0000) knlGS:0000000000000000 [5353358.825219] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [5353358.825220] CR2: ff5f5e897b024000 CR3: 0000000231532004 CR4: 0000000000771ef0 [5353358.825221] PKRU: 55555554 [5353358.825222] Call Trace: [5353358.825223] <TASK> [5353358.825224] ? show_trace_log_lvl+0x1c4/0x2df [5353358.825229] ? show_trace_log_lvl+0x1c4/0x2df [5353358.825232] ? sg_copy_buffer+0xc8/0x110 [5353358.825236] ? __die_body.cold+0x8/0xd [5353358.825238] ? page_fault_oops+0x134/0x170 [5353358.825242] ? kernelmode_fixup_or_oops+0x84/0x110 [5353358.825244] ? exc_page_fault+0xa8/0x150 [5353358.825247] ? asm_exc_page_fault+0x22/0x30 [5353358.825252] ? memcpy_erms+0x6/0x10 [5353358.825253] sg_copy_buffer+0xc8/0x110 [5353358.825259] qla2x00_process_vendor_specific+0x652/0x1320 [qla2xxx] [5353358.825317] qla24xx_bsg_request+0x1b2/0x2d0 [qla2xxx] Most routines in qla_bsg.c call bsg_done() only for success cases. However a few invoke it for failure case as well leading to a double free. Validate before calling bsg_done(). (CVE-2025-71238)

    在 Linux 内核中，以下漏洞已修复：

    net/schedsch_qfq不释放 qfq_change_class() 中的现有类 (CVE-2026-22999)

    在 Linux 内核中，以下漏洞已修复：

    macvlan修复 macvlan_forward_source() 中可能的 UAF (CVE-2026-23001)

    在 Linux 内核中，以下漏洞已修复：

    ip6_tunnel在 __ip6_tnl_rcv() 中使用 skb_vlan_inet_prepare() (CVE-2026-23003)

    在 Linux 内核中，以下漏洞已修复：

    ipv4ip_gre增强 ipgre_header()CVE-2026-23011

    在 Linux 内核中，以下漏洞已修复：

    pnfs/flexfiles修复 nfs4_ff_alloc_deviceid_node() 中的内存泄漏 (CVE-2026-23038)

    在 Linux 内核中，以下漏洞已修复：

    cryptoauthencesn - 拒绝过短的 AAD (assoclen<8) 以匹配 ESP/ESN 规范CVE-2026-23060]

    在 Linux 内核中，以下漏洞已修复：

    regmap修复 hwspinlock irqsave 例程中的争用条件 (CVE-2026-23071)

    在 Linux 内核中，以下漏洞已修复：

    net/sched强制 teql 只能用作根 qdisc (CVE-2026-23074)

    在 Linux 内核中，以下漏洞已修复：

    fou不允许 FOU_ATTR_IPPROTO 设置为 0。 (CVE-2026-23083)

    在 Linux 内核中，以下漏洞已修复：

    irqchip/gic-v3-its避免截断内存地址 (CVE-2026-23085)

    在 Linux 内核中，以下漏洞已修复：

    gue修复内部 IP 协议 0 的 skb 内存泄漏。(CVE-2026-23095

    在 Linux 内核中，以下漏洞已修复：

    migrate修正 hugetlb 文件作品集的锁定顺序 (CVE-2026-23097)

    在 Linux 内核中，以下漏洞已修复：

    ledsled-class仅在完全就绪时将 LED 添加到 leds_list (CVE-2026-23101)

    在 Linux 内核中，以下漏洞已修复：

    ipvlan使 addrs_lock 针对每个端口 (CVE-2026-23103)

    在 Linux 内核中，以下漏洞已修复：

    net/schedqfq使用 cl_is_active 确定类在 qfq_rm_from_ag 中是否处于活动状态 (CVE-2026-23105)

    在 Linux 内核中，以下漏洞已修复：

    scsicore最终完成相互争用时唤醒错误处理程序 (CVE-2026-23110)

    在 Linux 内核中，以下漏洞已修复：

    bonding提供指向 __skb_flow_dissect() 的网络指针 (CVE-2026-23119)

    在 Linux 内核中，以下漏洞已修复：

    sctp将 SCTP_CMD_ASSOC_SHKEY 移动到 SCTP_CMD_PEER_INIT 之后向右 (CVE-2026-23125)

    在 Linux 内核中，以下漏洞已修复：

    ext4修复 ext4_xattr_inode_update_ref 中的 iloc.bh 泄漏 (CVE-2026-23145)

    在 Linux 内核中，以下漏洞已修复：

    rocker修复 rocker_world_port_post_fini() 中的内存泄漏 (CVE-2026-23164)

    在 Linux 内核中，以下漏洞已修复：

    scsitargetiscsi修复 iscsit_dec_session_usage_count() 中的释放后使用 (CVE-2026-23193)

    在 Linux 内核中，以下漏洞已修复：

    KVM取消分配 irqfd 时不破坏 irqfd 路由类型 (CVE-2026-23198)

    在 Linux 内核中，以下漏洞已修复：

    macvlan修复 macvlan_common_newlink() 中的错误恢复 (CVE-2026-23209)

    在 Linux 内核中，以下漏洞已修复：

    scsitargetiscsi修复 iscsit_dec_conn_usage_count() 中的释放后使用 (CVE-2026-23216)

    在 Linux 内核中，以下漏洞已修复：crypto: virtio - Add spinlock protection with virtqueue notification When VM boots with one virtio-crypto PCI device and builtin backend, run openssl benchmark command with multiple processes, such as openssl speed -evp aes-128-cbc
    -engine afalg -seconds 10 -multi 32 openssl processes will hangup and there is error reported like this:
    virtio_crypto virtio0: dataq.0:id 3 is not a head! It seems that the data virtqueue need protection when it is handled for virtio done notification. If the spinlock protection is added in virtcrypto_done_task(), openssl benchmark with multiple processes works well. (CVE-2026-23229)

    在 Linux 内核中，以下漏洞已修复：romfs: check sb_set_blocksize() return value romfs_fill_super() ignores the return value of sb_set_blocksize(), which can fail if the requested block size is incompatible with the block device's configuration. This can be triggered by setting a loop device's block size larger than PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs filesystem on that device. When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the device has logical_block_size=32768, bdev_validate_blocksize() fails because the requested size is smaller than the device's logical block size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and continues mounting. The superblock's block size remains at the device's logical block size (32768). Later, when sb_bread() attempts I/O with this oversized block size, it triggers a kernel BUG in folio_set_bh():
    kernel BUG at fs/buffer.c:1582! BUG_ON(size > PAGE_SIZE); Fix by checking the return value of sb_set_blocksize() and failing the mount with -EINVAL if it returns 0. (CVE-2026-23238)

    在 Linux 内核中，以下漏洞已修复：

    netliquidio修复 VF setup_nic_devices() 清理中的差一错误 (CVE-2026-23256)

    在 Linux 内核中，以下漏洞已修复：

    netliquidio修复 PF setup_nic_devices() 清理中的差一错误 (CVE-2026-23257)

    在 Linux 内核中，以下漏洞已修复：

    netliquidio在队列设置之前初始化 netdev 指针 (CVE-2026-23258)

Tenable 已直接从测试产品的安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

因此，该软件受到 ALAS2023-2026-1491 公告中提及的多个漏洞影响。

    在 Linux 内核中，以下漏洞已修复：

    clkmediatek修复 of_iomap 内存泄漏 (CVE-2023-53424)

    在 Linux 内核中，以下漏洞已修复：

    wificfg80211添加 cfg80211_check_and_end_cac() 中缺少的锁定 (CVE-2025-38643)

    在 Linux 内核中，以下漏洞已修复：

    ACPIAPEI如果同步内存错误未恢复则将 SIGBUS 发送到当前任务 (CVE-2025-39763)

    在 Linux 内核中，以下漏洞已修复：

    devlinkrate未设置 devl_rate_nodes_destroy 中的父指针 (CVE-2025-40251)

    在 Linux 内核中，以下漏洞已修复：

    btrfs修复 btrfs_clear_space_info_full() 中的 racy 位字段写入 (CVE-2025-68358)

    在 Linux 内核中，以下漏洞已修复：

    mptcp确保 disconnect() 上重置上下文 (CVE-2025-71144)

    在 Linux 内核中，以下漏洞已修复：scsi: qla2xxx: Free sp in error path to fix system crash System crash seen during load/unload test in a loop, [61110.449331] qla2xxx [0000:27:00.0]-0042:0: Disabled MSI-X. [61110.467494] ============================================================================= [61110.467498] BUG qla2xxx_srbs (Tainted: G OE -------- --- ): Objects remaining in qla2xxx_srbs on __kmem_cache_shutdown() [61110.467501] ----------------------------------------------------------------------------- [61110.467502] Slab 0x000000000ffc8162 objects=51 used=1 fp=0x00000000e25d3d85 flags=0x57ffffc0010200(slab|head|node=1|zone=2|lastcpupid=0x1fffff) [61110.467509] CPU: 53 PID: 455206 Comm: rmmod Kdump: loaded Tainted: G OE -------- --- 5.14.0-284.11.1.el9_2.x86_64 #1 [61110.467513] Hardware name: HPE ProLiant DL385 Gen10 Plus v2/ProLiant DL385 Gen10 Plus v2, BIOS A42 08/17/2023 [61110.467515] Call Trace: [61110.467516] <TASK> [61110.467519] dump_stack_lvl+0x34/0x48 [61110.467526] slab_err.cold+0x53/0x67 [61110.467534] __kmem_cache_shutdown+0x16e/0x320 [61110.467540] kmem_cache_destroy+0x51/0x160 [61110.467544] qla2x00_module_exit+0x93/0x99 [qla2xxx] [61110.467607] ?
    __do_sys_delete_module.constprop.0+0x178/0x280 [61110.467613] ? syscall_trace_enter.constprop.0+0x145/0x1d0 [61110.467616] ? do_syscall_64+0x5c/0x90 [61110.467619] ? exc_page_fault+0x62/0x150 [61110.467622] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd [61110.467626] </TASK> [61110.467627] Disabling lock debugging due to kernel taint [61110.467635] Object 0x0000000026f7e6e6 @offset=16000 [61110.467639] ------------[ cut here ]------------ [61110.467639] kmem_cache_destroy qla2xxx_srbs: Slab cache still has objects when called from qla2x00_module_exit+0x93/0x99 [qla2xxx] [61110.467659] WARNING: CPU: 53 PID: 455206 at mm/slab_common.c:520 kmem_cache_destroy+0x14d/0x160 [61110.467718] CPU: 53 PID: 455206 Comm: rmmod Kdump: loaded Tainted: G B OE -------- --- 5.14.0-284.11.1.el9_2.x86_64 #1 [61110.467720] Hardware name: HPE ProLiant DL385 Gen10 Plus v2/ProLiant DL385 Gen10 Plus v2, BIOS A42 08/17/2023 [61110.467721] RIP: 0010:kmem_cache_destroy+0x14d/0x160 [61110.467724] Code: 99 7d 07 00 48 89 ef e8 e1 6a 07 00 eb b3 48 8b 55 60 48 8b 4c 24 20 48 c7 c6 70 fc 66 90 48 c7 c7 f8 ef a1 90 e8 e1 ed 7c 00 <0f> 0b eb 93 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 [61110.467725] RSP: 0018:ffffa304e489fe80 EFLAGS: 00010282 [61110.467727] RAX: 0000000000000000 RBX:
    ffffffffc0d9a860 RCX: 0000000000000027 [61110.467729] RDX: ffff8fd5ff9598a8 RSI: 0000000000000001 RDI:
    ffff8fd5ff9598a0 [61110.467730] RBP: ffff8fb6aaf78700 R08: 0000000000000000 R09: 0000000100d863b7 [61110.467731] R10: ffffa304e489fd20 R11: ffffffff913bef48 R12: 0000000040002000 [61110.467731] R13:
    0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [61110.467733] FS: 00007f64c89fb740(0000) GS:ffff8fd5ff940000(0000) knlGS:0000000000000000 [61110.467734] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [61110.467735] CR2: 00007f0f02bfe000 CR3: 00000020ad6dc005 CR4: 0000000000770ee0 [61110.467736] PKRU: 55555554 [61110.467737] Call Trace: [61110.467738] <TASK> [61110.467739] qla2x00_module_exit+0x93/0x99 [qla2xxx] [61110.467755] ? __do_sys_delete_module.constprop.0+0x178/0x280 Free sp in the error path to fix the crash. (CVE-2025-71232)

    在 Linux 内核中，以下漏洞已修复：PCI: endpoint: Avoid creating sub-groups asynchronously The asynchronous creation of sub-groups by a delayed work could lead to a NULL pointer dereference when the driver directory is removed before the work completes. The crash can be easily reproduced with the following commands: # cd /sys/kernel/config/pci_ep/functions/pci_epf_test # for i in {1..20}; do mkdir test && rmdir test; done BUG: kernel NULL pointer dereference, address:
    0000000000000088 ... Call Trace: configfs_register_group+0x3d/0x190 pci_epf_cfs_work+0x41/0x110 process_one_work+0x18f/0x350 worker_thread+0x25a/0x3a0 Fix this issue by using configfs_add_default_group() API which does not have the deadlock problem as configfs_register_group() and does not require the delayed work handler. [mani: slightly reworded the description and added stable list] (CVE-2025-71233)

    在 Linux 内核中，以下漏洞已修复：scsi: qla2xxx: Delay module unload while fabric scan in progress System crash seen during load/unload test in a loop. [105954.384919] RBP:
    ffff914589838dc0 R08: 0000000000000000 R09: 0000000000000086 [105954.384920] R10: 000000000000000f R11:
    ffffa31240904be5 R12: ffff914605f868e0 [105954.384921] R13: ffff914605f86910 R14: 0000000000008010 R15:
    00000000ddb7c000 [105954.384923] FS: 0000000000000000(0000) GS:ffff9163fec40000(0000) knlGS:0000000000000000 [105954.384925] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [105954.384926] CR2: 000055d31ce1d6a0 CR3: 0000000119f5e001 CR4: 0000000000770ee0 [105954.384928] PKRU: 55555554 [105954.384929] Call Trace: [105954.384931] <IRQ> [105954.384934] qla24xx_sp_unmap+0x1f3/0x2a0 [qla2xxx] [105954.384962] ? qla_async_scan_sp_done+0x114/0x1f0 [qla2xxx] [105954.384980] ? qla24xx_els_ct_entry+0x4de/0x760 [qla2xxx] [105954.384999] ? __wake_up_common+0x80/0x190 [105954.385004] ? qla24xx_process_response_queue+0xc2/0xaa0 [qla2xxx] [105954.385023] ? qla24xx_msix_rsp_q+0x44/0xb0 [qla2xxx] [105954.385040] ? __handle_irq_event_percpu+0x3d/0x190 [105954.385044] ? handle_irq_event+0x58/0xb0 [105954.385046] ? handle_edge_irq+0x93/0x240 [105954.385050] ?
    __common_interrupt+0x41/0xa0 [105954.385055] ? common_interrupt+0x3e/0xa0 [105954.385060] ? asm_common_interrupt+0x22/0x40 The root cause of this was that there was a free (dma_free_attrs) in the interrupt context. There was a device discovery/fabric scan in progress. A module unload was issued which set the UNLOADING flag. As part of the discovery, after receiving an interrupt a work queue was scheduled (which involved a work to be queued). Since the UNLOADING flag is set, the work item was not allocated and the mapped memory had to be freed. The free occurred in interrupt context leading to system crash. Delay the driver unload until the fabric scan is complete to avoid the crash. (CVE-2025-71235)

    在 Linux 内核中，以下漏洞已修复：scsi: qla2xxx: Validate sp before freeing associated memory System crash with the following signature [154563.214890] nvme nvme2: NVME-FC{1}: controller connect complete [154564.169363] qla2xxx [0000:b0:00.1]-3002:2: nvme: Sched: Set ZIO exchange threshold to 3. [154564.169405] qla2xxx [0000:b0:00.1]-ffffff:2: SET ZIO Activity exchange threshold to 5. [154565.539974] qla2xxx [0000:b0:00.1]-5013:2: RSCN database changed - 0078 0080 0000.
    [154565.545744] qla2xxx [0000:b0:00.1]-5013:2: RSCN database changed - 0078 00a0 0000. [154565.545857] qla2xxx [0000:b0:00.1]-11a2:2: FEC=enabled (data rate). [154565.552760] qla2xxx [0000:b0:00.1]-11a2:2:
    FEC=enabled (data rate). [154565.553079] BUG: kernel NULL pointer dereference, address: 00000000000000f8 [154565.553080] #PF: supervisor read access in kernel mode [154565.553082] #PF: error_code(0x0000) - not-present page [154565.553084] PGD 80000010488ab067 P4D 80000010488ab067 PUD 104978a067 PMD 0 [154565.553089] Oops: 0000 1 PREEMPT SMP PTI [154565.553092] CPU: 10 PID: 858 Comm: qla2xxx_2_dpc Kdump:
    loaded Tainted: G OE ------- --- 5.14.0-503.11.1.el9_5.x86_64 #1 [154565.553096] Hardware name: HPE Synergy 660 Gen10/Synergy 660 Gen10 Compute Module, BIOS I43 09/30/2024 [154565.553097] RIP:
    0010:qla_fab_async_scan.part.0+0x40b/0x870 [qla2xxx] [154565.553141] Code: 00 00 e8 58 a3 ec d4 49 89 e9 ba 12 20 00 00 4c 89 e6 49 c7 c0 00 ee a8 c0 48 c7 c1 66 c0 a9 c0 bf 00 80 00 10 e8 15 69 00 00 <4c> 8b 8d f8 00 00 00 4d 85 c9 74 35 49 8b 84 24 00 19 00 00 48 8b [154565.553143] RSP: 0018:ffffb4dbc8aebdd0 EFLAGS: 00010286 [154565.553145] RAX: 0000000000000000 RBX: ffff8ec2cf0908d0 RCX: 0000000000000002 [154565.553147] RDX: 0000000000000000 RSI: ffffffffc0a9c896 RDI: ffffb4dbc8aebd47 [154565.553148] RBP:
    0000000000000000 R08: ffffb4dbc8aebd45 R09: 0000000000ffff0a [154565.553150] R10: 0000000000000000 R11:
    000000000000000f R12: ffff8ec2cf0908d0 [154565.553151] R13: ffff8ec2cf090900 R14: 0000000000000102 R15:
    ffff8ec2cf084000 [154565.553152] FS: 0000000000000000(0000) GS:ffff8ed27f800000(0000) knlGS:0000000000000000 [154565.553154] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [154565.553155] CR2: 00000000000000f8 CR3: 000000113ae0a005 CR4: 00000000007706f0 [154565.553157] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [154565.553158] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [154565.553159] PKRU: 55555554 [154565.553160] Call Trace: [154565.553162] <TASK> [154565.553165] ? show_trace_log_lvl+0x1c4/0x2df [154565.553172] ? show_trace_log_lvl+0x1c4/0x2df [154565.553177] ? qla_fab_async_scan.part.0+0x40b/0x870 [qla2xxx] [154565.553215] ?
    __die_body.cold+0x8/0xd [154565.553218] ? page_fault_oops+0x134/0x170 [154565.553223] ? snprintf+0x49/0x70 [154565.553229] ? exc_page_fault+0x62/0x150 [154565.553238] ? asm_exc_page_fault+0x22/0x30 Check for sp being non NULL before freeing any associated memory (CVE-2025-71236)

    在 Linux 内核中，以下漏洞已修复：nilfs2: Fix potential block overflow that cause system hang When a user executes the FITRIM command, an underflow can occur when calculating nblocks if end_block is too small. Since nblocks is of type sector_t, which is u64, a negative nblocks value will become a very large positive integer. This ultimately leads to the block layer function
    __blkdev_issue_discard() taking an excessively long time to process the bio chain, and the ns_segctor_sem lock remains held for a long period. This prevents other tasks from acquiring the ns_segctor_sem lock, resulting in the hang reported by syzbot in [1]. If the ending block is too small, typically if it is smaller than 4KiB range, depending on the usage of the segment 0, it may be possible to attempt a discard request beyond the device size causing the hang. Exiting successfully and assign the discarded size (0 in this case) to range->len. Although the start and len values in the user input range are too small, a conservative strategy is adopted here to safely ignore them, which is equivalent to a no-op; it will not perform any trimming and will not throw an error. [1] task:segctord state:D stack:28968 pid:6093 tgid:6093 ppid:2 task_flags:0x200040 flags:0x00080000 Call Trace: rwbase_write_lock+0x3dd/0x750 kernel/locking/rwbase_rt.c:272 nilfs_transaction_lock+0x253/0x4c0 fs/nilfs2/segment.c:357 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2569 [inline] nilfs_segctor_thread+0x6ec/0xe00 fs/nilfs2/segment.c:2684 [ryusuke: corrected part of the commit message about the consequences] (CVE-2025-71237)

    在 Linux 内核中，以下漏洞已修复：scsi: qla2xxx: Fix bsg_done() causing double free Kernel panic observed on system, [5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000 [5353358.825194] #PF: supervisor write access in kernel mode [5353358.825195] #PF: error_code(0x0002) - not-present page [5353358.825196] PGD 100006067 P4D 0 [5353358.825198] Oops:
    0002 [#1] PREEMPT SMP NOPTI [5353358.825200] CPU: 5 PID: 2132085 Comm: qlafwupdate.sub Kdump: loaded Tainted: G W L ------- --- 5.14.0-503.34.1.el9_5.x86_64 #1 [5353358.825203] Hardware name: HPE ProLiant DL360 Gen11/ProLiant DL360 Gen11, BIOS 2.44 01/17/2025 [5353358.825204] RIP: 0010:memcpy_erms+0x6/0x10 [5353358.825211] RSP: 0018:ff591da8f4f6b710 EFLAGS: 00010246 [5353358.825212] RAX: ff5f5e897b024000 RBX:
    0000000000007090 RCX: 0000000000001000 [5353358.825213] RDX: 0000000000001000 RSI: ff591da8f4fed090 RDI:
    ff5f5e897b024000 [5353358.825214] RBP: 0000000000010000 R08: ff5f5e897b024000 R09: 0000000000000000 [5353358.825215] R10: ff46cf8c40517000 R11: 0000000000000001 R12: 0000000000008090 [5353358.825216] R13:
    ff591da8f4f6b720 R14: 0000000000001000 R15: 0000000000000000 [5353358.825218] FS: 00007f1e88d47740(0000) GS:ff46cf935f940000(0000) knlGS:0000000000000000 [5353358.825219] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [5353358.825220] CR2: ff5f5e897b024000 CR3: 0000000231532004 CR4: 0000000000771ef0 [5353358.825221] PKRU: 55555554 [5353358.825222] Call Trace: [5353358.825223] <TASK> [5353358.825224] ? show_trace_log_lvl+0x1c4/0x2df [5353358.825229] ? show_trace_log_lvl+0x1c4/0x2df [5353358.825232] ? sg_copy_buffer+0xc8/0x110 [5353358.825236] ? __die_body.cold+0x8/0xd [5353358.825238] ? page_fault_oops+0x134/0x170 [5353358.825242] ? kernelmode_fixup_or_oops+0x84/0x110 [5353358.825244] ? exc_page_fault+0xa8/0x150 [5353358.825247] ? asm_exc_page_fault+0x22/0x30 [5353358.825252] ? memcpy_erms+0x6/0x10 [5353358.825253] sg_copy_buffer+0xc8/0x110 [5353358.825259] qla2x00_process_vendor_specific+0x652/0x1320 [qla2xxx] [5353358.825317] qla24xx_bsg_request+0x1b2/0x2d0 [qla2xxx] Most routines in qla_bsg.c call bsg_done() only for success cases. However a few invoke it for failure case as well leading to a double free. Validate before calling bsg_done(). (CVE-2025-71238)

    在 Linux 内核中，以下漏洞已修复：

    mptcp修复 mptcp_pm_nl_flush_addrs_doit() 中的争用 (CVE-2026-23169)

    在 Linux 内核中，以下漏洞已修复：bus: fsl-mc: fix use-after-free in driver_override_show() The driver_override_show() function reads the driver_override string without holding the device_lock. However, driver_override_store() uses driver_set_override(), which modifies and frees the string while holding the device_lock. This can result in a concurrent use-after-free if the string is freed by the store function while being read by the show function. Fix this by holding the device_lock around the read operation. (CVE-2026-23221)

    在 Linux 内核中，以下漏洞已修复：crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly The existing allocation of scatterlists in omap_crypto_copy_sg_lists() was allocating an array of scatterlist pointers, not scatterlist objects, resulting in a 4x too small allocation. Use sizeof(*new_sg) to get the correct object size.
    (CVE-2026-23222)

    在 Linux 内核中，以下漏洞已修复：smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() On kthread_run() failure in ksmbd_tcp_new_connection(), the transport is freed via free_transport(), which does not decrement active_num_conn, leaking this counter.
    Replace free_transport() with ksmbd_tcp_disconnect(). (CVE-2026-23228)

    在 Linux 内核中，以下漏洞已修复：crypto: virtio - Add spinlock protection with virtqueue notification When VM boots with one virtio-crypto PCI device and builtin backend, run openssl benchmark command with multiple processes, such as openssl speed -evp aes-128-cbc
    -engine afalg -seconds 10 -multi 32 openssl processes will hangup and there is error reported like this:
    virtio_crypto virtio0: dataq.0:id 3 is not a head! It seems that the data virtqueue need protection when it is handled for virtio done notification. If the spinlock protection is added in virtcrypto_done_task(), openssl benchmark with multiple processes works well. (CVE-2026-23229)

    在 Linux 内核中，以下漏洞已修复：smb: client: split cached_fid bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield byte in struct cached_fid but are updated in different code paths that may run concurrently. Bitfield assignments generate byte read-modify-write operations (e.g. `orb $mask, addr` on x86_64), so updating one flag can restore stale values of the others. A possible interleaving is: CPU1: load old byte (has_lease=1, on_list=1) CPU2: clear both flags (store 0) CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits To avoid this class of races, convert these flags to separate bool fields. (CVE-2026-23230)

    在 Linux 内核中，以下漏洞已修复：romfs: check sb_set_blocksize() return value romfs_fill_super() ignores the return value of sb_set_blocksize(), which can fail if the requested block size is incompatible with the block device's configuration. This can be triggered by setting a loop device's block size larger than PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs filesystem on that device. When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the device has logical_block_size=32768, bdev_validate_blocksize() fails because the requested size is smaller than the device's logical block size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and continues mounting. The superblock's block size remains at the device's logical block size (32768). Later, when sb_bread() attempts I/O with this oversized block size, it triggers a kernel BUG in folio_set_bh():
    kernel BUG at fs/buffer.c:1582! BUG_ON(size > PAGE_SIZE); Fix by checking the return value of sb_set_blocksize() and failing the mount with -EINVAL if it returns 0. (CVE-2026-23238)

    在 Linux 内核中，以下漏洞已修复：

    macvlan观察 macvlan_common_newlink() 错误路径中的 RCU 宽限期 (CVE-2026-23273)

Tenable 已直接从测试产品的安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Debian 11 主机上安装的多个程序包受到 dla-4498 公告中提及的多个漏洞影响。

    ------------------------------------------------------------------------- Debian LTS 公告 DLA-4498-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/Ben Hutchings 2026 年 3 月 13 日 https://wiki.debian.org/LTS-------------------------------------------------------------------------

    程序包：linux 版本：5.10.251-1 CVE ID：CVE-2022-50516 CVE-2025-38201 CVE-2025-71222 CVE-2025-71224 CVE-2025-71232 CVE-2025-71235 CVE-2025-71236 CVE-2025-71237 CVE-2025-71238 CVE-2026-23112 CVE-2026-23176 CVE-2026-23190 CVE-2026-23193 CVE-2026-23198 CVE-2026-23209 CVE-2026-23216 CVE-2026-23222 CVE-2026-23229 CVE-2026-23234 CVE-2026-23235 CVE-2026-23236 CVE-2026-23237 CVE-2026-23238 Debian 缺陷：1127597

    在 Linux 内核中发现多个可能导致权限升级、拒绝服务或信息泄漏的漏洞。

    Qualys Threat Research Unit (TRU) 在 Apparmor 中发现了多个漏洞。可在 https://www.qualys.com/2026/03/10/crack-armor.txt 处 Qualys 公告中找到详细信息

    对于 Debian 11 bullseye，已在 5.10.251-1 版本中修复这些问题。此版本还修复了上次更新中的回归问题，还额外包含了来自稳定更新版本 5.10.250 和 5.10.251 的大量错误修复。

    建议您升级 linux 程序包。

    如需了解 linux 的详细安全状态，请参阅其安全跟踪页面：
    https://security-tracker.debian.org/tracker/linux

    有关 Debian LTS 安全公告、如何将这些更新应用到系统以及常见问题解答的更多信息，请访问以下网址：https://wiki.debian.org/LTSAttachment:signature.ascDescription: PGP signature

Tenable 已直接从 Debian 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Debian 12 主机上安装的多个程序包受到 dsa-6163 公告中提及的多个漏洞影响。

    - ------------------------------------------------------------------------- Debian 安全公告 DSA-6163-1 security@debian.org https://www.debian.org/security/Salvatore Bonaccorso 2026 年 3 月 12 日 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    程序包：linux CVE ID：CVE-2023-53424 CVE-2024-26822 CVE-2024-57895 CVE-2025-22026 CVE-2025-23155 CVE-2025-37786 CVE-2025-37822 CVE-2025-37920 CVE-2025-38201 CVE-2025-38643 CVE-2025-39763 CVE-2025-40082 CVE-2025-40251 CVE-2025-68358 CVE-2025-71089 CVE-2025-71144 CVE-2025-71220 CVE-2025-71222 CVE-2025-71224 CVE-2025-71232 CVE-2025-71233 CVE-2025-71235 CVE-2025-71236 CVE-2025-71237 CVE-2025-71238 CVE-2026-23111 CVE-2026-23112 CVE-2026-23169 CVE-2026-23176 CVE-2026-23178 CVE-2026-23180 CVE-2026-23182 CVE-2026-23187 CVE-2026-23190 CVE-2026-23193 CVE-2026-23198 CVE-2026-23202 CVE-2026-23205 CVE-2026-23206 CVE-2026-23209 CVE-2026-23216 CVE-2026-23220 CVE-2026-23221 CVE-2026-23222 CVE-2026-23228 CVE-2026-23229 CVE-2026-23230 CVE-2026-23234 CVE-2026-23235 CVE-2026-23236 CVE-2026-23237 CVE-2026-23238

    在 Linux 内核中发现多个可能导致权限升级、拒绝服务或信息泄漏的漏洞。

    Qualys Threat Research Unit (TRU) 在 Apparmor 中发现了多个漏洞。可在 https://www.qualys.com/2026/03/10/crack-armor.txt 处 Qualys 公告中找到详细信息

    对于旧稳定发行版本 (bookworm)，已在版本 6.1.164-1 中修复这些问题。

    建议您升级 linux 程序包。

    如需了解 linux 的详细安全状态，请参阅其安全跟踪页面：
    https://security-tracker.debian.org/tracker/linux

    有关 Debian 安全公告、如何将这些更新应用到系统以及常见问题解答的更多信息，请访问以下网址：https://www.debian.org/security/

    邮件列表：debian-security-announce@lists.debian.org

Tenable 已直接从 Debian 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Debian 11 主机上安装的多个程序包受到 dla-4499 公告中提及的多个漏洞影响。

    ------------------------------------------------------------------------- Debian LTS 公告 DLA-4499-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/Ben Hutchings 2026 年 3 月 13 日 https://wiki.debian.org/LTS-------------------------------------------------------------------------

    程序包：linux-6.1 版本：6.1.164-1~deb11u1 CVE ID：CVE-2023-53424 CVE-2024-26822 CVE-2024-57895 CVE-2025-22026 CVE-2025-23155 CVE-2025-37786 CVE-2025-37822 CVE-2025-37920 CVE-2025-38201 CVE-2025-38643 CVE-2025-39763 CVE-2025-40082 CVE-2025-40251 CVE-2025-68358 CVE-2025-71089 CVE-2025-71144 CVE-2025-71220 CVE-2025-71222 CVE-2025-71224 CVE-2025-71232 CVE-2025-71233 CVE-2025-71235 CVE-2025-71236 CVE-2025-71237 CVE-2025-71238 CVE-2026-23111 CVE-2026-23112 CVE-2026-23169 CVE-2026-23176 CVE-2026-23178 CVE-2026-23180 CVE-2026-23182 CVE-2026-23187 CVE-2026-23190 CVE-2026-23193 CVE-2026-23198 CVE-2026-23202 CVE-2026-23205 CVE-2026-23206 CVE-2026-23209 CVE-2026-23216 CVE-2026-23220 CVE-2026-23221 CVE-2026-23222 CVE-2026-23228 CVE-2026-23229 CVE-2026-23230 CVE-2026-23234 CVE-2026-23235 CVE-2026-23236 CVE-2026-23237 CVE-2026-23238 Debian 缺陷：1127597

    在 Linux 内核中发现多个可能导致权限升级、拒绝服务或信息泄漏的漏洞。

    Qualys Threat Research Unit (TRU) 在 Apparmor 中发现了多个漏洞。可在 https://www.qualys.com/2026/03/10/crack-armor.txt 处 Qualys 公告中找到详细信息

    对于 Debian 11 bullseye，已在 6.1.164-1~deb11u1 版本中修复这些问题。此版本还修复了上次更新中的回归问题，还额外包含了来自稳定更新版本 6.1.163 和 6.1.164 的大量错误修复。

    建议您升级 linux-6.1 程序包。

    如需了解 linux-6.1 的详细安全状态，请参阅其安全跟踪页面：
    https://security-tracker.debian.org/tracker/linux-6.1

    有关 Debian LTS 安全公告、如何将这些更新应用到系统以及常见问题解答的更多信息，请访问以下网址：https://wiki.debian.org/LTSAttachment:signature.ascDescription: PGP signature

Tenable 已直接从 Debian 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
303468	Oracle Linux 10 / 9：Unbreakable Enterprise 内核 (ELSA-2026-50160)	Nessus	Oracle Linux Local Security Checks	2026/3/24	2026/3/24	critical
299432	Linux Distros 未修补的漏洞：CVE-2025-71237	Nessus	Misc.	2026/2/18	2026/3/19	medium
303103	Amazon Linux 2 内核 --advisory ALAS2KERNEL-5。10-2026-114 (ALASKERNEL-5.10-2026-114)	Nessus	Amazon Linux Local Security Checks	2026/3/19	2026/3/31	high
304299	Amazon Linux 2023：bpftool、kernel、kernel-devel (ALAS2023-2026-1491)	Nessus	Amazon Linux Local Security Checks	2026/3/30	2026/4/1	high
302189	Debian dla-4498：ata-modules-5.10.0-38-armmp-di - 安全更新	Nessus	Debian Local Security Checks	2026/3/13	2026/3/20	critical
302008	Debian dsa-6163：affs-modules-6.1.0-43-4kc-malta-di - 安全更新	Nessus	Debian Local Security Checks	2026/3/12	2026/3/20	critical
302188	Debian dla-4499：linux-config-6.1 - 安全更新	Nessus	Debian Local Security Checks	2026/3/13	2026/3/20	critical

检测

插件搜索

critical

medium

high

high

critical

critical

critical