Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - bonding防止 bond_header_parse() 中發生潛在的無限迴圈如果已設定兩個連結裝置的堆疊bond_header_parse() 可能會進入迴圈因為 skb->dev 一律指向階層頂層。新增新的 const struct net_device *dev 參數至 (struct header_ops)->parse() 方法以確保遞回為有邊界並呼叫最終的分葉剖析方法。 (CVE-2026-23451)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - bonding防止 bond_header_parse() 中可能发生的无限循环如果设置了两个 bonding 设备堆栈则 bond_header_parse() 会循环因为 skb->dev 始终指向层次结构顶部。添加新的 const struct net_device *dev 参数到 (struct header_ops)->parse() 方法以确保限制递归并调用最终的叶解析方法。 (CVE-2026-23451)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

リモートの SUSE Linux SLES12 ホストには、SUSE-SU-2026:2914-1 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    SUSE Linux Enterprise 12 SP5 カーネルが更新され、さまざまなセキュリティの問題が修正されました

    以下のセキュリティ問題が修正されました。

    - CVE-2023-53995:net:ipv4:__inet_del_ifa() 内の 1 つのメモリリークを修正します(bsc#1255616)。
    - CVE-2026-23255:net:/proc/net/ptype に適切な RCU 保護を追加します(bsc#1259891)。
    - CVE-2026-23451:bonding:bond_header_parse() の無限ループの可能性を防止します(bsc#1261604)。
    - CVE-2026-31462:drm/amdgpu:PASID の即時再利用ケースを防止します(bsc#1262655)。
    - CVE-2026-31499:Bluetooth:L2CAP:l2cap_conn_del() のデッドロックを修正します(bsc#1262674)。
    - CVE-2026-31502:チーム:非イーサネットポートとのheader_ops型の取り違え(Type Confusion)を修正します(bsc#1263072)。
    - CVE-2026-31592:KVM:SEV:kvm->lock (bsc#1263123) で sev_mem_enc_register_region() の *すべて* を保護します。
    - CVE-2026-31670:net:rfkill:無制限の数の rfkill イベントが作成されないようにします(bsc#1263573)。
    - CVE-2026-31677:crypto:af_alg - 受信バッファバジェットにより RX SG 抽出を制限します(bsc#1263560)。
    - CVE-2026-31680:net:ipv6:flowlabel:RCU 分解(bsc#1263563)まで排他的オプションの解放を延期します。
    - CVE-2026-31773:Bluetooth:SMP:MITM 状態からレガシーレスポンダー STK 認証を派生させます(bsc#1264039)。
    - CVE-2026-31781:drm/ioc32:drm_compat_ioctlパス上の投機を停止します(bsc#1264033)。
    - CVE-2026-43035:net:sched:cls_api:情報漏洩を防ぐために、tcm_infoをゼロに初期化するためにtc_chain_fill_nodeを修正します(bsc#1263996)。
    - CVE-2026-43036:net:TCPv4 GSO frag_offチェックに skb_header_pointer() を使用します(bsc#1263993)。
    - CVE-2026-43043:crypto:af-alg - scatterwalk の NULL ポインターデリファレンスを修正します(bsc#1264088)。
    - CVE-2026-43047:HID:マルチタッチ:レポートの応答がリクエストに一致するかどうかをチェックします(bsc#1264073)。
    - CVE-2026-43051:HID:wacom:wacom_intuos_bt_irq の領域外読み取りを修正します(bsc#1264065)。
    - CVE-2026-43080:l2tp:UDP encap で大きなパケットをドロップします(bsc#1264236)。
    - CVE-2026-43089:xfrm_user:build_mapping() での情報漏洩を修正します(bsc#1264261)。
    - CVE-2026-43093:xsk:tailroom と min frame(bsc#1264254)を考慮して UMEM ヘッドルーム検証を強化します。
    - CVE-2026-43112:fs/smb/client:cifs_sanitize_prepath における領域外読み取りを修正します(bsc#1264437)。
    - CVE-2026-43117:btrfs:tracepoints:イベント btrfs_sync_file() の dentry から適切なスーパーブロックを取得します(bsc#1264414)。
    - CVE-2026-43139:xfrm6:xfrm6_get_saddr() の初期化されていない saddr を修正(bsc#1264294)。
    - CVE-2026-43233:netfilter:nf_conntrack_h323:decode_choice() での OOB 読み取りを修正します(bsc#1264337)。
    - CVE-2026-43279:ALSA:usb-audio:サイレンシング時での OOB 書き込みに対するサニティチェックを追加します(bsc#1264618)。
    - CVE-2026-43336:lib/crypto:chacha:範囲を離れる前にpermuted_stateをゼロにします(bsc#1265113)。
    - CVE-2026-43456:bonding:bond_setup_by_slave() での型の取り違え(Type Confusion)を修正します(bsc#1264734)。
    - CVE-2026-43472:unshare:unshare_fs() 処理を修正します(bsc#1264748)。
    - CVE-2026-43492:lib/crypto:mpi:mpi_read_raw_from_sgl() の整数アンダーフローを修正します(bsc#1265629)。
    - CVE-2026-45840:openvswitch:cap upcall PID 配列サイズと事前サイズ vport 応答(bsc#1266397)。
    - CVE-2026-45912:ext4:エクステント分割中にエクステントをキャッシュしません(bsc#1266899)。
    - CVE-2026-45948:ext4:ext4_ext_shift_extents() でのメモリ漏洩を修正します(bsc#1266929)。
    - CVE-2026-45960:hfsplus:ノードがすでに hfs_bnode_create に存在する場合、エラーを返します(bsc#1266971)。
    - CVE-2026-46028:crypto:algif_aead - 非同期 AEAD リクエスト用のスナップショット IV(bsc#1267430)。
    - CVE-2026-46065:fbdev:defio:構造体の寿命から繰延 I/O を切断します(bsc#1267458)。
    - CVE-2026-46069:wifi:mwifiex:mwifiex_adapter_cleanup() の use-after-free を修正します(bsc#1267437)。
    - CVE-2026-46082:KVM:SVM:EFER の場合、INVLPGA に #UD を注入します。SVME=0(bsc#1267473)。
    - CVE-2026-46124:isofs:isofs_export_iget の NFS ファイルハンドルからのブロック番号を検証します(bsc#1266847)。
    - CVE-2026-46133:RDMA/rxe:ICRC 処理の前に不明のオペコードを拒否します(bsc#1266928)。
    - CVE-2026-46253:pstore/ram:persistent_ram_save_old() のバッファオーバーフローを修正します(bsc#1267635)。
    - CVE-2026-46254:AppArmor:apparmor が整列されていない dfa テーブルを処理できるようにします(bsc#1267637)。
    - CVE-2026-46266: inet: IPPROTO_RAW を使用する RAW ソケットは受信 ICMP を破棄する必要がある (bsc#1267684)。
    - CVE-2026-46275:Bluetooth:hci_uart:閉じるパスと初期化パスの UAF と競合状態を修正します(bsc#1267968)。
    - CVE-2026-46299:hfsplus:hfsplus_fill_super() で解放された保持ロックを修正します(bsc#1267920)。
    - CVE-2026-46320:タップ:tap_get_user_xdp() のエラーパスのページを解放します(bsc#1267993)。
    - CVE-2026-46328:apparmor:POSIX CPU タイマーの rlimit を修正します(bsc#1268037)。
    - CVE-2026-46331: net/sched: pedit の部分的な COW によるページキャッシュ破損の修正 (bsc#1265421)。
    - CVE-2026-52918: Bluetooth: accept_q へのアクセスをシリアル化 (bsc#1269100)。
    - CVE-2026-52923:ipc:next_id割り当てを有効な ID 範囲(bsc#1269033)に制限します。
    - CVE-2026-52954:libceph:decode_choose_args() の rbtree 挿入エラーを処理します(bsc#1269137)。
    - CVE-2026-52955:libceph:crush_decode() で発生する可能性のある領域外アクセスを修正します(bsc#1269159)。
    - CVE-2026-52957:libceph:decode_choose_args() で発生する可能性のある null-ptr-deref を修正します(bsc#1269103)。
    - CVE-2026-52962:ceph:__ceph_setxattr() のバッファ漏洩を修正します(bsc#1269135)。
    - CVE-2026-52972:crypto:af_alg - AEAD AD の長さを 0x80000000 に制限します(bsc#1269195)。
    - CVE-2026-53040:ocfs2:freefrag スキャン中にbg_bitsを検証します(bsc#1269397)。
    - CVE-2026-53041:ocfs2:バッファがいっぱいの際の listxattr 処理を修正します(bsc#1269398)。
    - CVE-2026-53075:ppp:添付されていない ioctl の場合は、ターゲット netns に CAP_NET_ADMIN が必要です(bsc#1269690)。
    - CVE-2026-53148:thunderbolt:割り当てサイズ(bsc#1269786)に XDomain 応答データコピーをクランプします。
    - CVE-2026-53150:thunderbolt:バリデーターでゼロレングスのプロパティエントリを拒否します(bsc#1269386)。
    - CVE-2026-53194:USB:シリアル:kl5kusb105:バルクアウトバッファオーバーフローを修正します(bsc#1269904)。
    - CVE-2026-53253:Bluetooth:bnep:bnep_rx_frame() 拡張処理の正しくない長さ解析を修正します(bsc#1269574)。
    - CVE-2026-53287:audit:CAPSET レコードの間違った継承機能を修正します(bsc#1269506)。
    - CVE-2026-53359: KVM: x86: 予期しないロールによるシャドウページングのメモリ解放後使用 (Use-After-Free) を修正 (bsc#1270059)。

    セキュリティに関係しない以下の問題が修正されました。

    - btrfs:tracepoints:btrfs_sync_file() のアトミックコンテキストでのスリープを修正します(git-fixes)。
    - libceph:非アサーション rbtree 挿入ヘルパーを追加します(bsc#1269137)。

Tenable は、前述の記述ブロックを SUSE セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - bondingbond_header_parse() の潜在的な無限ループを防ぎます。bond_header_parse() は、2 つの結合デバイスのスタックが設定されている場合、ループする可能性があります。これは、skb->dev が常に階層のトップを指すためです。新しい const struct net_device *dev パラメーターを struct header_ops)->parse() メソッドに追加し、再帰が限定され、最終的なリーフ解析メソッドが呼び出されます。CVE-2026-23451

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2914-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2023-53995: net: ipv4: fix one memleak in __inet_del_ifa() (bsc#1255616).
    - CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
    - CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
    - CVE-2026-31462: drm/amdgpu: prevent immediate PASID reuse case (bsc#1262655).
    - CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
    - CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
    - CVE-2026-31592: KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock (bsc#1263123).
    - CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created     (bsc#1263573).
    - CVE-2026-31677: crypto: af_alg - limit RX SG extraction by receive buffer budget (bsc#1263560).
    - CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
    - CVE-2026-31773: Bluetooth: SMP: derive legacy responder STK authentication from MITM state     (bsc#1264039).
    - CVE-2026-31781: drm/ioc32: stop speculation on the drm_compat_ioctl path (bsc#1264033).
    - CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an     info-leak       (bsc#1263996).
    - CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).
    - CVE-2026-43043: crypto: af-alg - fix NULL pointer dereference in scatterwalk (bsc#1264088).
    - CVE-2026-43047: HID: multitouch: Check to ensure report responses match the request (bsc#1264073).
    - CVE-2026-43051: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (bsc#1264065).
    - CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).
    - CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).
    - CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame     (bsc#1264254).
    - CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).
    - CVE-2026-43117: btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()     (bsc#1264414).
    - CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).
    - CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).
    - CVE-2026-43279: ALSA: usb-audio: Add sanity check for OOB writes at silencing (bsc#1264618).
    - CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).
    - CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).
    - CVE-2026-43472: unshare: fix unshare_fs() handling (bsc#1264748).
    - CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).
    - CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies (bsc#1266397).
    - CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).
    - CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).
    - CVE-2026-45960: hfsplus: return error when node already exists in hfs_bnode_create (bsc#1266971).
    - CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).
    - CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).
    - CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).
    - CVE-2026-46082: KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (bsc#1267473).
    - CVE-2026-46124: isofs: validate block number from NFS file handle in isofs_export_iget (bsc#1266847).
    - CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
    - CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).
    - CVE-2026-46254: AppArmor: Allow apparmor to handle unaligned dfa tables (bsc#1267637).
    - CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).
    - CVE-2026-46275: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (bsc#1267968).
    - CVE-2026-46299: hfsplus: fix held lock freed on hfsplus_fill_super() (bsc#1267920).
    - CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).
    - CVE-2026-46328: apparmor: fix rlimit for posix cpu timers (bsc#1268037).
    - CVE-2026-46331: net/sched: fix pedit partial COW leading to page cache (bsc#1265421).
    - CVE-2026-52918: Bluetooth: serialize accept_q access (bsc#1269100).
    - CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).
    - CVE-2026-52954: libceph: handle rbtree insertion error in decode_choose_args() (bsc#1269137).
    - CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).
    - CVE-2026-52957: libceph: Fix potential null-ptr-deref in decode_choose_args() (bsc#1269103).
    - CVE-2026-52962: ceph: fix a buffer leak in __ceph_setxattr() (bsc#1269135).
    - CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269195).
    - CVE-2026-53040: ocfs2: validate bg_bits during freefrag scan (bsc#1269397).
    - CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).
    - CVE-2026-53075: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (bsc#1269690).
    - CVE-2026-53148: thunderbolt: Clamp XDomain response data copy to allocation size (bsc#1269786).
    - CVE-2026-53150: thunderbolt: Reject zero-length property entries in validator (bsc#1269386).
    - CVE-2026-53194: USB: serial: kl5kusb105: fix bulk-out buffer overflow (bsc#1269904).
    - CVE-2026-53253: Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling     (bsc#1269574).
    - CVE-2026-53287: audit: fix incorrect inheritable capability in CAPSET records (bsc#1269506).
    - CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role (bsc#1270059).

    The following non security issues were fixed:

    - btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() (git-fixes).
    - libceph: add non-asserting rbtree insertion helper (bsc#1269137).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: bonding: prevent potential infinite     loop in bond_header_parse() bond_header_parse() can loop if a stack of two bonding devices is setup,     because skb->dev always points to the hierarchy top. Add new const struct net_device *dev parameter to     (struct header_ops)->parse() method to make sure the recursion is bounded, and that the final leaf parse     method is called. (CVE-2026-23451)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0796 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-31502:
    In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping     after cycling ILOCK. xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork     mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction,     which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow     fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping     beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the     wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio     write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence     counter changes across the ILOCK cycle.

    CVE-2026-43456:
    In the Linux kernel, the following vulnerability has been resolved:

    bonding: fix type confusion in bond_setup_by_slave()

    kernel BUG at net/core/skbuff.c:2306!     Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI     RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306     RSP: 0018:ffffc90004aff760 EFLAGS: 00010293     RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e     RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900     RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000     R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780     R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0     Call Trace:
     <TASK>      ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900      dev_hard_header include/linux/netdevice.h:3439 [inline]      packet_snd net/packet/af_packet.c:3028 [inline]      packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108      sock_sendmsg_nosec net/socket.c:727 [inline]
     __sock_sendmsg net/socket.c:742 [inline]
     ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592
     ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646
     __sys_sendmsg+0x170/0x220 net/socket.c:2678      do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]      do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94      entry_SYSCALL_64_after_hwframe+0x77/0x7f     RIP: 0033:0x7fe1a0e6c1a9

    When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,     bond_setup_by_slave() directly copies the slave's header_ops to the     bond device:

      bond_dev->header_ops = slave_dev->header_ops;

    This causes a type confusion when dev_hard_header() is later called     on the bond device. Functions like ipgre_header(), ip6gre_header(),all use     netdev_priv(dev) to access their device-specific private data. When     called with the bond device, netdev_priv() returns the bond's private     data (struct bonding) instead of the expected type (e.g. struct     ip_tunnel), leading to garbage values being read and kernel crashes.

    Fix this by introducing bond_header_ops with wrapper functions that     delegate to the active slave's header_ops using the slave's own     device. This ensures netdev_priv() in the slave's header functions     always receives the correct device.

    The fix is placed in the bonding driver rather than individual device     drivers, as the root cause is bond blindly inheriting header_ops from     the slave without considering that these callbacks expect a specific     netdev_priv() layout.

    The type confusion can be observed by adding a printk in     ipgre_header() and running the following commands:

      ip link add dummy0 type dummy       ip addr add 10.0.0.1/24 dev dummy0       ip link set dummy0 up       ip link add gre1 type gre local 10.0.0.1       ip link add bond1 type bond mode active-backup       ip link set gre1 master bond1       ip link set gre1 up       ip link set bond1 up       ip addr add fe80::1/64 dev bond1

    CVE-2026-23451:
    In the Linux kernel, the following vulnerability has been resolved:

    team: fix header_ops type confusion with non-Ethernet ports

    Similar to commit 950803f72547 (bonding: fix type confusion in     bond_setup_by_slave()) team has the same class of header_ops type     confusion.

    For non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops     directly. When the team device later calls dev_hard_header() or     dev_parse_header(), these callbacks can run with the team net_device     instead of the real lower device, so netdev_priv(dev) is interpreted as     the wrong private type and can crash.

    The syzbot report shows a crash in bond_header_create(), but the root     cause is in team: the topology is gre -> bond -> team, and team calls     the inherited header_ops with its own net_device instead of the lower     device, so bond_header_create() receives a team device and interprets     netdev_priv() as bonding private data, causing a type confusion crash.

    Fix this by introducing team header_ops wrappers for create/parse,     selecting a team port under RCU, and calling the lower device callbacks     with port->dev, so each callback always sees the correct net_device     context.

    Also pass the selected lower device to the lower parse callback, so     recursion is bounded in stacked non-Ethernet topologies and parse     callbacks always run with the correct device context.

    CVE-2026-64600:
    In the Linux kernel, the following vulnerability has been resolved:

    bonding: prevent potential infinite loop in bond_header_parse()

    bond_header_parse() can loop if a stack of two bonding devices is setup,     because skb->dev always points to the hierarchy top.

    Add new const struct net_device *dev parameter to     (struct header_ops)->parse() method to make sure the recursion     is bounded, and that the final leaf parse method is called.

    CVE-2026-64564:
    In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own     transport in DEL-IP processing. sctp_process_asconf() caches the transport the ASCONF chunk is processed     against in asconf->transport. For an ASCONF located through its Address Parameter, that cached transport     corresponds to the Address Parameter, which need not be the packet's source address. A single ASCONF can     carry DEL-IP for the cached transport followed by a wildcard DEL-IP, causing use-after-free of the freed     transport.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0793 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-31502:
    In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping     after cycling ILOCK. xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork     mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction,     which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow     fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping     beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the     wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio     write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence     counter changes across the ILOCK cycle.

    CVE-2026-43456:
    In the Linux kernel, the following vulnerability has been resolved:

    bonding: fix type confusion in bond_setup_by_slave()

    kernel BUG at net/core/skbuff.c:2306!     Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI     RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306     RSP: 0018:ffffc90004aff760 EFLAGS: 00010293     RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e     RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900     RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000     R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780     R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0     Call Trace:
     <TASK>      ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900      dev_hard_header include/linux/netdevice.h:3439 [inline]      packet_snd net/packet/af_packet.c:3028 [inline]      packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108      sock_sendmsg_nosec net/socket.c:727 [inline]
     __sock_sendmsg net/socket.c:742 [inline]
     ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592
     ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646
     __sys_sendmsg+0x170/0x220 net/socket.c:2678      do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]      do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94      entry_SYSCALL_64_after_hwframe+0x77/0x7f     RIP: 0033:0x7fe1a0e6c1a9

    When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,     bond_setup_by_slave() directly copies the slave's header_ops to the     bond device:

      bond_dev->header_ops = slave_dev->header_ops;

    This causes a type confusion when dev_hard_header() is later called     on the bond device. Functions like ipgre_header(), ip6gre_header(),all use     netdev_priv(dev) to access their device-specific private data. When     called with the bond device, netdev_priv() returns the bond's private     data (struct bonding) instead of the expected type (e.g. struct     ip_tunnel), leading to garbage values being read and kernel crashes.

    Fix this by introducing bond_header_ops with wrapper functions that     delegate to the active slave's header_ops using the slave's own     device. This ensures netdev_priv() in the slave's header functions     always receives the correct device.

    The fix is placed in the bonding driver rather than individual device     drivers, as the root cause is bond blindly inheriting header_ops from     the slave without considering that these callbacks expect a specific     netdev_priv() layout.

    The type confusion can be observed by adding a printk in     ipgre_header() and running the following commands:

      ip link add dummy0 type dummy       ip addr add 10.0.0.1/24 dev dummy0       ip link set dummy0 up       ip link add gre1 type gre local 10.0.0.1       ip link add bond1 type bond mode active-backup       ip link set gre1 master bond1       ip link set gre1 up       ip link set bond1 up       ip addr add fe80::1/64 dev bond1

    CVE-2026-64600:
    In the Linux kernel, the following vulnerability has been resolved:

    team: fix header_ops type confusion with non-Ethernet ports

    Similar to commit 950803f72547 (bonding: fix type confusion in     bond_setup_by_slave()) team has the same class of header_ops type     confusion.

    For non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops     directly. When the team device later calls dev_hard_header() or     dev_parse_header(), these callbacks can run with the team net_device     instead of the real lower device, so netdev_priv(dev) is interpreted as     the wrong private type and can crash.

    The syzbot report shows a crash in bond_header_create(), but the root     cause is in team: the topology is gre -> bond -> team, and team calls     the inherited header_ops with its own net_device instead of the lower     device, so bond_header_create() receives a team device and interprets     netdev_priv() as bonding private data, causing a type confusion crash.

    Fix this by introducing team header_ops wrappers for create/parse,     selecting a team port under RCU, and calling the lower device callbacks     with port->dev, so each callback always sees the correct net_device     context.

    Also pass the selected lower device to the lower parse callback, so     recursion is bounded in stacked non-Ethernet topologies and parse     callbacks always run with the correct device context.

    CVE-2026-23451:
    In the Linux kernel, the following vulnerability has been resolved:

    bonding: prevent potential infinite loop in bond_header_parse()

    bond_header_parse() can loop if a stack of two bonding devices is setup,     because skb->dev always points to the hierarchy top.

    Add new const struct net_device *dev parameter to     (struct header_ops)->parse() method to make sure the recursion     is bounded, and that the final leaf parse method is called.

    CVE-2026-64564:
    In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own     transport in DEL-IP processing. sctp_process_asconf() caches the transport the ASCONF chunk is processed     against in asconf->transport. For an ASCONF located through its Address Parameter, that cached transport     corresponds to the Address Parameter, which need not be the packet's source address. A single ASCONF can     carry DEL-IP for the cached transport followed by a wildcard DEL-IP, causing use-after-free of the freed     transport.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0797 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2026-31502:
    In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping     after cycling ILOCK. xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork     mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction,     which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow     fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping     beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the     wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio     write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence     counter changes across the ILOCK cycle.

    CVE-2026-43456:
    In the Linux kernel, the following vulnerability has been resolved:

    bonding: fix type confusion in bond_setup_by_slave()

    kernel BUG at net/core/skbuff.c:2306!     Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI     RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306     RSP: 0018:ffffc90004aff760 EFLAGS: 00010293     RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e     RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900     RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000     R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780     R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0     Call Trace:
     <TASK>      ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900      dev_hard_header include/linux/netdevice.h:3439 [inline]      packet_snd net/packet/af_packet.c:3028 [inline]      packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108      sock_sendmsg_nosec net/socket.c:727 [inline]
     __sock_sendmsg net/socket.c:742 [inline]
     ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592
     ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646
     __sys_sendmsg+0x170/0x220 net/socket.c:2678      do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]      do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94      entry_SYSCALL_64_after_hwframe+0x77/0x7f     RIP: 0033:0x7fe1a0e6c1a9

    When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,     bond_setup_by_slave() directly copies the slave's header_ops to the     bond device:

      bond_dev->header_ops = slave_dev->header_ops;

    This causes a type confusion when dev_hard_header() is later called     on the bond device. Functions like ipgre_header(), ip6gre_header(),all use     netdev_priv(dev) to access their device-specific private data. When     called with the bond device, netdev_priv() returns the bond's private     data (struct bonding) instead of the expected type (e.g. struct     ip_tunnel), leading to garbage values being read and kernel crashes.

    Fix this by introducing bond_header_ops with wrapper functions that     delegate to the active slave's header_ops using the slave's own     device. This ensures netdev_priv() in the slave's header functions     always receives the correct device.

    The fix is placed in the bonding driver rather than individual device     drivers, as the root cause is bond blindly inheriting header_ops from     the slave without considering that these callbacks expect a specific     netdev_priv() layout.

    The type confusion can be observed by adding a printk in     ipgre_header() and running the following commands:

      ip link add dummy0 type dummy       ip addr add 10.0.0.1/24 dev dummy0       ip link set dummy0 up       ip link add gre1 type gre local 10.0.0.1       ip link add bond1 type bond mode active-backup       ip link set gre1 master bond1       ip link set gre1 up       ip link set bond1 up       ip addr add fe80::1/64 dev bond1

    CVE-2026-23451:
    In the Linux kernel, the following vulnerability has been resolved:

    team: fix header_ops type confusion with non-Ethernet ports

    Similar to commit 950803f72547 (bonding: fix type confusion in     bond_setup_by_slave()) team has the same class of header_ops type     confusion.

    For non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops     directly. When the team device later calls dev_hard_header() or     dev_parse_header(), these callbacks can run with the team net_device     instead of the real lower device, so netdev_priv(dev) is interpreted as     the wrong private type and can crash.

    The syzbot report shows a crash in bond_header_create(), but the root     cause is in team: the topology is gre -> bond -> team, and team calls     the inherited header_ops with its own net_device instead of the lower     device, so bond_header_create() receives a team device and interprets     netdev_priv() as bonding private data, causing a type confusion crash.

    Fix this by introducing team header_ops wrappers for create/parse,     selecting a team port under RCU, and calling the lower device callbacks     with port->dev, so each callback always sees the correct net_device     context.

    Also pass the selected lower device to the lower parse callback, so     recursion is bounded in stacked non-Ethernet topologies and parse     callbacks always run with the correct device context.

    CVE-2026-64600:
    In the Linux kernel, the following vulnerability has been resolved:

    bonding: prevent potential infinite loop in bond_header_parse()

    bond_header_parse() can loop if a stack of two bonding devices is setup,     because skb->dev always points to the hierarchy top.

    Add new const struct net_device *dev parameter to     (struct header_ops)->parse() method to make sure the recursion     is bounded, and that the final leaf parse method is called.

    CVE-2026-64564:
    In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own     transport in DEL-IP processing. sctp_process_asconf() caches the transport the ASCONF chunk is processed     against in asconf->transport. For an ASCONF located through its Address Parameter, that cached transport     corresponds to the Address Parameter, which need not be the packet's source address. A single ASCONF can     carry DEL-IP for the cached transport followed by a wildcard DEL-IP, causing use-after-free of the freed     transport.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0792 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-31502:
    In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping     after cycling ILOCK. xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork     mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction,     which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow     fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping     beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the     wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio     write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence     counter changes across the ILOCK cycle.

    CVE-2026-53362:
    In the Linux kernel, the following vulnerability has been resolved:

    eventpoll: fix ep_remove struct eventpoll / struct file UAF

    ep_remove() (via ep_remove_file()) cleared file->f_ep under     file->f_lock but then kept using @file inside the critical section     (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock).
    A concurrent __fput() taking the eventpoll_release() fastpath in     that window observed the transient NULL, skipped     eventpoll_release_file() and ran to f_op->release / file_free().

    For the epoll-watches-epoll case, f_op->release is     ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which     kfree()s the watched struct eventpoll. Its embedded ->refs     hlist_head is exactly where epi->fllink.pprev points, so the     subsequent hlist_del_rcu()'s *pprev = next scribbles into freed     kmalloc-192 memory.

    In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot     backing @file could be recycled by alloc_empty_file() --     reinitializing f_lock and f_ep -- while ep_remove() is still     nominally inside that lock. The upshot is an attacker-controllable     kmem_cache_free() against the wrong slab cache.

    Pin @file via epi_fget() at the top of ep_remove() and gate the     critical section on the pin succeeding. With the pin held @file     cannot reach refcount zero, which holds __fput() off and     transitively keeps the watched struct eventpoll alive across the     hlist_del_rcu() and the f_lock use, closing both UAFs.

    If the pin fails @file has already reached refcount zero and its
    __fput() is in flight. Because we bailed before clearing f_ep,     that path takes the eventpoll_release() slow path into     eventpoll_release_file() and blocks on ep->mtx until the waiter     side's ep_clear_and_put() drops it. The bailed epi's share of     ep->refcount stays intact, so the trailing ep_refcount_dec_and_test()     in ep_clear_and_put() cannot free the eventpoll out from under     eventpoll_release_file(); the orphaned epi is then cleaned up     there.

    A successful pin also proves we are not racing     eventpoll_release_file() on this epi, so drop the now-redundant     re-check of epi->dying under f_lock. The cheap lockless     READ_ONCE(epi->dying) fast-path bailout stays.

    CVE-2026-43456:
    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: account for fraggap on the paged allocation path

    In __ip6_append_data(), when the paged-allocation branch is taken     (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are     computed as

            alloclen = fragheaderlen + transhdrlen;
            pagedlen = datalen - transhdrlen;

    datalen already includes fraggap (datalen = length + fraggap). When     fraggap is non-zero, this is not the first skb and transhdrlen is zero.
    The fraggap bytes carried over from the previous skb are copied just past     the fragment headers in the new skb's linear area. The linear area is     therefore undersized by fraggap bytes while pagedlen is overstated by the     same amount, and the copy writes past skb->end into the trailing     skb_shared_info.

    An unprivileged user can trigger this via a UDPv6 socket using     MSG_MORE together with MSG_SPLICE_PAGES.

    The bad accounting was introduced by commit 773ba4fe9104 (ipv6:
    avoid partial copy for zc). Before commit ce650a166335 (udp6: Fix
    __ip6_append_data()'s handling of MSG_SPLICE_PAGES), the negative     copy value caused -EINVAL to be returned. That later commit allowed     MSG_SPLICE_PAGES to proceed in this case, making the corruption     triggerable.

    The non-paged branch sets alloclen to fraglen, which already accounts     for fraggap because datalen does. Bring the paged branch in line by     adding fraggap to alloclen and subtracting it from pagedlen.

    After this adjustment, copy no longer collapses to -fraggap on the     paged path, so remove the stale comment describing that old arithmetic.
    Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES     case, remove the MSG_SPLICE_PAGES exception from the negative copy check.

    CVE-2026-46242:
    In the Linux kernel, the following vulnerability has been resolved:

    bonding: fix type confusion in bond_setup_by_slave()

    kernel BUG at net/core/skbuff.c:2306!     Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI     RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306     RSP: 0018:ffffc90004aff760 EFLAGS: 00010293     RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e     RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900     RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000     R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780     R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033     CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0     Call Trace:
     <TASK>      ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900      dev_hard_header include/linux/netdevice.h:3439 [inline]      packet_snd net/packet/af_packet.c:3028 [inline]      packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108      sock_sendmsg_nosec net/socket.c:727 [inline]
     __sock_sendmsg net/socket.c:742 [inline]
     ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592
     ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646
     __sys_sendmsg+0x170/0x220 net/socket.c:2678      do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]      do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94      entry_SYSCALL_64_after_hwframe+0x77/0x7f     RIP: 0033:0x7fe1a0e6c1a9

    When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,     bond_setup_by_slave() directly copies the slave's header_ops to the     bond device:

      bond_dev->header_ops = slave_dev->header_ops;

    This causes a type confusion when dev_hard_header() is later called     on the bond device. Functions like ipgre_header(), ip6gre_header(),all use     netdev_priv(dev) to access their device-specific private data. When     called with the bond device, netdev_priv() returns the bond's private     data (struct bonding) instead of the expected type (e.g. struct     ip_tunnel), leading to garbage values being read and kernel crashes.

    Fix this by introducing bond_header_ops with wrapper functions that     delegate to the active slave's header_ops using the slave's own     device. This ensures netdev_priv() in the slave's header functions     always receives the correct device.

    The fix is placed in the bonding driver rather than individual device     drivers, as the root cause is bond blindly inheriting header_ops from     the slave without considering that these callbacks expect a specific     netdev_priv() layout.

    The type confusion can be observed by adding a printk in     ipgre_header() and running the following commands:

      ip link add dummy0 type dummy       ip addr add 10.0.0.1/24 dev dummy0       ip link set dummy0 up       ip link add gre1 type gre local 10.0.0.1       ip link add bond1 type bond mode active-backup       ip link set gre1 master bond1       ip link set gre1 up       ip link set bond1 up       ip addr add fe80::1/64 dev bond1

    CVE-2026-23451:
    In the Linux kernel, the following vulnerability has been resolved:

    team: fix header_ops type confusion with non-Ethernet ports

    Similar to commit 950803f72547 (bonding: fix type confusion in     bond_setup_by_slave()) team has the same class of header_ops type     confusion.

    For non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops     directly. When the team device later calls dev_hard_header() or     dev_parse_header(), these callbacks can run with the team net_device     instead of the real lower device, so netdev_priv(dev) is interpreted as     the wrong private type and can crash.

    The syzbot report shows a crash in bond_header_create(), but the root     cause is in team: the topology is gre -> bond -> team, and team calls     the inherited header_ops with its own net_device instead of the lower     device, so bond_header_create() receives a team device and interprets     netdev_priv() as bonding private data, causing a type confusion crash.

    Fix this by introducing team header_ops wrappers for create/parse,     selecting a team port under RCU, and calling the lower device callbacks     with port->dev, so each callback always sees the correct net_device     context.

    Also pass the selected lower device to the lower parse callback, so     recursion is bounded in stacked non-Ethernet topologies and parse     callbacks always run with the correct device context.

    CVE-2026-64600:
    In the Linux kernel, the following vulnerability has been resolved:

    bonding: prevent potential infinite loop in bond_header_parse()

    bond_header_parse() can loop if a stack of two bonding devices is setup,     because skb->dev always points to the hierarchy top.

    Add new const struct net_device *dev parameter to     (struct header_ops)->parse() method to make sure the recursion     is bounded, and that the final leaf parse method is called.

    CVE-2026-64531:
    In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized     nested action attrs. Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. An     oversized generated container can be closed with a truncated nla_len, causing later dump or teardown to     walk a structurally different stream than the one that was validated. An oversized nested CLONE/CT action     may cause subsequent bytes to be interpreted as independent actions.

    CVE-2026-64564:
    In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own     transport in DEL-IP processing. sctp_process_asconf() caches the transport the ASCONF chunk is processed     against in asconf->transport. For an ASCONF located through its Address Parameter, that cached transport     corresponds to the Address Parameter, which need not be the packet's source address. A single ASCONF can     carry DEL-IP for the cached transport followed by a wildcard DEL-IP, causing use-after-free of the freed     transport.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
305182	Linux Distros 未修補的弱點：CVE-2026-23451	Nessus	Misc.	2026/4/7	2026/7/18	high
305182	Linux Distros 未修补的漏洞：CVE-2026-23451	Nessus	Misc.	2026/4/7	2026/7/18	high
329305	openSUSE 16:cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21388-1)	Nessus	SuSE Local Security Checks	2026/7/24	2026/9/2	high
326000	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2800-1)	Nessus	SuSE Local Security Checks	2026/7/9	2026/9/2	high
326705	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2914-1)	Nessus	SuSE Local Security Checks	2026/7/14	2026/7/15	high
305182	Linux Distros のパッチ未適用の脆弱性: CVE-2026-23451	Nessus	Misc.	2026/4/7	2026/7/18	high
329305	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21388-1)	Nessus	SuSE Local Security Checks	2026/7/24	2026/9/2	high
326000	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2800-1)	Nessus	SuSE Local Security Checks	2026/7/9	2026/9/2	high
326705	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2914-1)	Nessus	SuSE Local Security Checks	2026/7/14	2026/7/15	high
305182	Linux Distros Unpatched Vulnerability : CVE-2026-23451	Nessus	Misc.	2026/4/7	2026/7/18	high
333127	TencentOS Server 3: kernel (TSSA-2026:0796)	Nessus	Tencent Local Security Checks	2026/8/6	2026/8/10	critical
333137	TencentOS Server 3: kernel (TSSA-2026:0793)	Nessus	Tencent Local Security Checks	2026/8/6	2026/8/10	critical
333145	TencentOS Server 2: kernel (TSSA-2026:0797)	Nessus	Tencent Local Security Checks	2026/8/6	2026/8/10	critical
333128	TencentOS Server 4: kernel (TSSA-2026:0792)	Nessus	Tencent Local Security Checks	2026/8/6	2026/9/2	critical

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

critical

critical

critical

critical