遠端 CentOS Linux 9 主機已安裝的套件會受到 kernel-5.14.0-719.el9 組建變更記錄中提及的多個弱點影響。

  - 已解決 Linux 核心中的下列弱點：cxl/port: Fix use after free of parent_port in cxl_detach_ep() cxl_detach_ep() is called during bottom-up removal when all CXL memory devices beneath a switch port have been removed. For each port in the hierarchy it locks both the port and its parent, removes the endpoint, and if the port is now empty, marks it dead and unregisters the port by calling delete_switch_port(). There are two places during this work where the parent_port may be used after freeing: First, a concurrent detach may have already processed a port by the time a second worker finds it via bus_find_device(). Without pinning parent_port, it may already be freed when we discover port->dead and attempt to unlock the parent_port. In a production kernel that's a silent memory corruption, with lock debug, it looks like this: []DEBUG_LOCKS_WARN_ON(__owner_task(owner) != get_current()) []WARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1ee/0x310 []Call Trace:
    []mutex_unlock+0xd/0x20 []cxl_detach_ep+0x180/0x400 [cxl_core] []devm_action_release+0x10/0x20 []devres_release_all+0xa8/0xe0 []device_unbind_cleanup+0xd/0xa0 []really_probe+0x1a6/0x3e0 Second, delete_switch_port() releases three devm actions registered against parent_port. The last of those is unregister_port() and it calls device_unregister() on the child port, which can cascade. If parent_port is now also empty the device core may unregister and free it too. So by the time delete_switch_port() returns, parent_port may be free, and the subsequent device_unlock(&parent_port->dev) operates on freed memory. The kernel log looks same as above, with a different offset in cxl_detach_ep(). Both of these issues stem from the absence of a lifetime guarantee between a child port and its parent port. Establish a lifetime rule for ports: child ports hold a reference to their parent device until release. Take the reference when the port is allocated and drop it when released. This ensures the parent is valid for the full lifetime of the child and eliminates the use after free window in cxl_detach_ep(). This is easily reproduced with a reload of cxl_acpi in QEMU with CXL devices present. (CVE-2026-31530)

  - 已解決 Linux 核心中的下列弱點：crypto: tegra - Add missing CRYPTO_ALG_ASYNC The tegra crypto driver failed to set the CRYPTO_ALG_ASYNC on its asynchronous algorithms, causing the crypto API to select them for users that request only synchronous algorithms. This causes crashes (at least). Fix this by adding the flag like what the other drivers do. Also remove the unnecessary CRYPTO_ALG_TYPE_* flags, since those just get ignored and overridden by the registration function anyway. (CVE-2026-31739)

  - 已解決 Linux 核心中的下列弱點：ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2 and passed to icmp6_send(), it uses IP6CB(skb2). IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm.
    The cipso offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm at offset 18. If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO). This would scan the inner, attacker-controlled IPv6 packet starting at that offset, potentially returning a fake TLV without checking if the remaining packet length can hold the full 18-byte struct ipv6_destopt_hao. Could mip6_addr_swap() then perform a 16-byte swap that extends past the end of the packet data into skb_shared_info? Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and ip6ip6_err() to prevent this? This patch implements the first suggestion. I am not sure if ip6ip6_err() needs to be changed. A separate patch would be better anyway. (CVE-2026-43038)

  - 已解決 Linux 核心中的下列弱點：procfs: fix missing RCU protection when reading real_parent in do_task_stat() When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- do_task_stat var = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <--- Too late to protect task->real_parent! task_pid_ptr <--- UAF! rcu_read_unlock This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing task->real_parent. (CVE-2026-46259)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - crypto：tegra - 添加缺失的 CRYPTO_ALG_ASYNC tegra 加密驱动未能为其异步算法设置 CRYPTO_ALG_ASYNC，导致加密 API 为仅请求同步算法的用户选择了这些驱动。这至少会导致崩溃。像其他司机那样添加旗帜来解决这个问题。
    另外，移除不必要的CRYPTO_ALG_TYPE_*标志，因为这些标记最终会被注册功能忽略和覆盖。（CVE-2026-31739）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

远程 CentOS Linux 9 主机上存在安装的程序包，该程序包受到 kernel-5.14.0-719.el9 版本变更日志中提及的多个漏洞的影响。

  - 已修复 Linux 内核中的下列漏洞：cxl/port: Fix use after free of parent_port in cxl_detach_ep() cxl_detach_ep() is called during bottom-up removal when all CXL memory devices beneath a switch port have been removed. For each port in the hierarchy it locks both the port and its parent, removes the endpoint, and if the port is now empty, marks it dead and unregisters the port by calling delete_switch_port(). There are two places during this work where the parent_port may be used after freeing: First, a concurrent detach may have already processed a port by the time a second worker finds it via bus_find_device(). Without pinning parent_port, it may already be freed when we discover port->dead and attempt to unlock the parent_port. In a production kernel that's a silent memory corruption, with lock debug, it looks like this: []DEBUG_LOCKS_WARN_ON(__owner_task(owner) != get_current()) []WARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1ee/0x310 []Call Trace:
    []mutex_unlock+0xd/0x20 []cxl_detach_ep+0x180/0x400 [cxl_core] []devm_action_release+0x10/0x20 []devres_release_all+0xa8/0xe0 []device_unbind_cleanup+0xd/0xa0 []really_probe+0x1a6/0x3e0 Second, delete_switch_port() releases three devm actions registered against parent_port. The last of those is unregister_port() and it calls device_unregister() on the child port, which can cascade. If parent_port is now also empty the device core may unregister and free it too. So by the time delete_switch_port() returns, parent_port may be free, and the subsequent device_unlock(&parent_port->dev) operates on freed memory. The kernel log looks same as above, with a different offset in cxl_detach_ep(). Both of these issues stem from the absence of a lifetime guarantee between a child port and its parent port. Establish a lifetime rule for ports: child ports hold a reference to their parent device until release. Take the reference when the port is allocated and drop it when released. This ensures the parent is valid for the full lifetime of the child and eliminates the use after free window in cxl_detach_ep(). This is easily reproduced with a reload of cxl_acpi in QEMU with CXL devices present. (CVE-2026-31530)

  - 已修复 Linux 内核中的下列漏洞：crypto: tegra - Add missing CRYPTO_ALG_ASYNC The tegra crypto driver failed to set the CRYPTO_ALG_ASYNC on its asynchronous algorithms, causing the crypto API to select them for users that request only synchronous algorithms. This causes crashes (at least). Fix this by adding the flag like what the other drivers do. Also remove the unnecessary CRYPTO_ALG_TYPE_* flags, since those just get ignored and overridden by the registration function anyway. (CVE-2026-31739)

  - 已修复 Linux 内核中的下列漏洞：ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2 and passed to icmp6_send(), it uses IP6CB(skb2). IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm.
    The cipso offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm at offset 18. If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO). This would scan the inner, attacker-controlled IPv6 packet starting at that offset, potentially returning a fake TLV without checking if the remaining packet length can hold the full 18-byte struct ipv6_destopt_hao. Could mip6_addr_swap() then perform a 16-byte swap that extends past the end of the packet data into skb_shared_info? Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and ip6ip6_err() to prevent this? This patch implements the first suggestion. I am not sure if ip6ip6_err() needs to be changed. A separate patch would be better anyway. (CVE-2026-43038)

  - 已修复 Linux 内核中的下列漏洞：procfs: fix missing RCU protection when reading real_parent in do_task_stat() When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- do_task_stat var = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <--- Too late to protect task->real_parent! task_pid_ptr <--- UAF! rcu_read_unlock This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing task->real_parent. (CVE-2026-46259)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 加密：tegra - 新增缺失的CRYPTO_ALG_ASYNC tegra 加密驅動程式未能設定非同步演算法的CRYPTO_ALG_ASYNC，導致加密 API 選擇了僅請求同步演算法的使用者。這至少會導致當機。像其他駕駛一樣，加入旗幟來解決這個問題。
    也要移除不必要的 CRYPTO_ALG_TYPE_* 標記，因為那些標記通常會被註冊功能忽略並覆蓋。（CVE-2026-31739）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

リモートの CentOS Linux 9 ホストには、kernel-5.14.0-719.el9 ビルド変更ログで参照されているように、複数の脆弱性の影響を受けるパッケージがインストールされています。

  - Linux カーネルでは、以下の脆弱性が解決されています: cxl/port: Fix use after free of parent_port in cxl_detach_ep() cxl_detach_ep() is called during bottom-up removal when all CXL memory devices beneath a switch port have been removed. For each port in the hierarchy it locks both the port and its parent, removes the endpoint, and if the port is now empty, marks it dead and unregisters the port by calling delete_switch_port(). There are two places during this work where the parent_port may be used after freeing: First, a concurrent detach may have already processed a port by the time a second worker finds it via bus_find_device(). Without pinning parent_port, it may already be freed when we discover port->dead and attempt to unlock the parent_port. In a production kernel that's a silent memory corruption, with lock debug, it looks like this: []DEBUG_LOCKS_WARN_ON(__owner_task(owner) != get_current()) []WARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1ee/0x310 []Call Trace:
    []mutex_unlock+0xd/0x20 []cxl_detach_ep+0x180/0x400 [cxl_core] []devm_action_release+0x10/0x20 []devres_release_all+0xa8/0xe0 []device_unbind_cleanup+0xd/0xa0 []really_probe+0x1a6/0x3e0 Second, delete_switch_port() releases three devm actions registered against parent_port. The last of those is unregister_port() and it calls device_unregister() on the child port, which can cascade. If parent_port is now also empty the device core may unregister and free it too. So by the time delete_switch_port() returns, parent_port may be free, and the subsequent device_unlock(&parent_port->dev) operates on freed memory. The kernel log looks same as above, with a different offset in cxl_detach_ep(). Both of these issues stem from the absence of a lifetime guarantee between a child port and its parent port. Establish a lifetime rule for ports: child ports hold a reference to their parent device until release. Take the reference when the port is allocated and drop it when released. This ensures the parent is valid for the full lifetime of the child and eliminates the use after free window in cxl_detach_ep(). This is easily reproduced with a reload of cxl_acpi in QEMU with CXL devices present. (CVE-2026-31530)

  - Linux カーネルでは、以下の脆弱性が解決されています: crypto: tegra - Add missing CRYPTO_ALG_ASYNC The tegra crypto driver failed to set the CRYPTO_ALG_ASYNC on its asynchronous algorithms, causing the crypto API to select them for users that request only synchronous algorithms. This causes crashes (at least). Fix this by adding the flag like what the other drivers do. Also remove the unnecessary CRYPTO_ALG_TYPE_* flags, since those just get ignored and overridden by the registration function anyway. (CVE-2026-31739)

  - Linux カーネルでは、以下の脆弱性が解決されています: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2 and passed to icmp6_send(), it uses IP6CB(skb2). IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm.
    The cipso offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm at offset 18. If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO). This would scan the inner, attacker-controlled IPv6 packet starting at that offset, potentially returning a fake TLV without checking if the remaining packet length can hold the full 18-byte struct ipv6_destopt_hao. Could mip6_addr_swap() then perform a 16-byte swap that extends past the end of the packet data into skb_shared_info? Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and ip6ip6_err() to prevent this? This patch implements the first suggestion. I am not sure if ip6ip6_err() needs to be changed. A separate patch would be better anyway. (CVE-2026-43038)

  - Linux カーネルでは、以下の脆弱性が解決されています: procfs: fix missing RCU protection when reading real_parent in do_task_stat() When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- do_task_stat var = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <--- Too late to protect task->real_parent! task_pid_ptr <--- UAF! rcu_read_unlock This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing task->real_parent. (CVE-2026-46259)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - crypto: tegra - 欠落したCRYPTO_ALG_ASYNC tegra暗号ドライバーが非同期アルゴリズムのCRYPTO_ALG_ASYNCを設定しなかったため、同期アルゴリズムのみを要求するユーザーには暗号APIが選択しました。これがクラッシュを引き起こします(少なくとも)。他のドライバーのようにフラグを追加すれば修正できます。
    また、不要なCRYPTO_ALG_TYPE_*フラグも削除してください。これらは結局登録機能によって無視され、上書きされてしまいます。(CVE-2026-31739)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

An update of the linux package has been released.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-719.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use after free of     parent_port in cxl_detach_ep() cxl_detach_ep() is called during bottom-up removal when all CXL memory     devices beneath a switch port have been removed. For each port in the hierarchy it locks both the port and     its parent, removes the endpoint, and if the port is now empty, marks it dead and unregisters the port by     calling delete_switch_port(). There are two places during this work where the parent_port may be used     after freeing: First, a concurrent detach may have already processed a port by the time a second worker     finds it via bus_find_device(). Without pinning parent_port, it may already be freed when we discover     port->dead and attempt to unlock the parent_port. In a production kernel that's a silent memory     corruption, with lock debug, it looks like this: []DEBUG_LOCKS_WARN_ON(__owner_task(owner) !=     get_current()) []WARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1ee/0x310 []Call Trace:
    []mutex_unlock+0xd/0x20 []cxl_detach_ep+0x180/0x400 [cxl_core] []devm_action_release+0x10/0x20     []devres_release_all+0xa8/0xe0 []device_unbind_cleanup+0xd/0xa0 []really_probe+0x1a6/0x3e0 Second,     delete_switch_port() releases three devm actions registered against parent_port. The last of those is     unregister_port() and it calls device_unregister() on the child port, which can cascade. If parent_port is     now also empty the device core may unregister and free it too. So by the time delete_switch_port()     returns, parent_port may be free, and the subsequent device_unlock(&parent_port->dev) operates on freed     memory. The kernel log looks same as above, with a different offset in cxl_detach_ep(). Both of these     issues stem from the absence of a lifetime guarantee between a child port and its parent port. Establish a     lifetime rule for ports: child ports hold a reference to their parent device until release. Take the     reference when the port is allocated and drop it when released. This ensures the parent is valid for the     full lifetime of the child and eliminates the use after free window in cxl_detach_ep(). This is easily     reproduced with a reload of cxl_acpi in QEMU with CXL devices present. (CVE-2026-31530)

  - In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Add missing     CRYPTO_ALG_ASYNC The tegra crypto driver failed to set the CRYPTO_ALG_ASYNC on its asynchronous     algorithms, causing the crypto API to select them for users that request only synchronous algorithms. This     causes crashes (at least). Fix this by adding the flag like what the other drivers do. Also remove the     unnecessary CRYPTO_ALG_TYPE_* flags, since those just get ignored and overridden by the registration     function anyway. (CVE-2026-31739)

  - In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in     ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an     outer IPv4 ICMP error packet where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2 and     passed to icmp6_send(), it uses IP6CB(skb2). IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm.
    The cipso offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm at offset 18. If an     attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao would be a non-zero offset. Inside     icmp6_send(), mip6_addr_swap() is called and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO). This     would scan the inner, attacker-controlled IPv6 packet starting at that offset, potentially returning a     fake TLV without checking if the remaining packet length can hold the full 18-byte struct     ipv6_destopt_hao. Could mip6_addr_swap() then perform a 16-byte swap that extends past the end of the     packet data into skb_shared_info? Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and     ip6ip6_err() to prevent this? This patch implements the first suggestion. I am not sure if ip6ip6_err()     needs to be changed. A separate patch would be better anyway. (CVE-2026-43038)

  - In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection     when reading real_parent in do_task_stat() When reading /proc/[pid]/stat, do_task_stat() accesses     task->real_parent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- do_task_stat var     = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <---     Too late to protect task->real_parent! task_pid_ptr <--- UAF! rcu_read_unlock This patch uses     task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing     task->real_parent. (CVE-2026-46259)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - crypto: tegra - Add missing CRYPTO_ALG_ASYNC The tegra crypto driver failed to set the CRYPTO_ALG_ASYNC on     its asynchronous algorithms, causing the crypto API to select them for users that request only synchronous     algorithms. This causes crashes (at least). Fix this by adding the flag like what the other drivers do.
    Also remove the unnecessary CRYPTO_ALG_TYPE_* flags, since those just get ignored and overridden by the     registration function anyway. (CVE-2026-31739)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
324007	CentOS 9 ： kernel-5.14.0-719.el9	Nessus	CentOS Local Security Checks	2026/7/1	2026/7/1	high
311718	Linux Distros 未修补的漏洞：CVE-2026-31739	Nessus	Misc.	2026/5/2	2026/7/31	high
324007	CentOS 9：kernel-5.14.0-719.el9	Nessus	CentOS Local Security Checks	2026/7/1	2026/7/1	high
311718	Linux Distros 未修補的弱點：CVE-2026-31739	Nessus	Misc.	2026/5/2	2026/7/31	high
324007	CentOS 9:kernel-5.14.0-719.el9	Nessus	CentOS Local Security Checks	2026/7/1	2026/7/1	high
311718	Linux Distros のパッチ未適用の脆弱性: CVE-2026-31739	Nessus	Misc.	2026/5/2	2026/7/31	high
318365	Photon OS 5.0: Linux PHSA-2026-5.0-0849	Nessus	PhotonOS Local Security Checks	2026/6/3	2026/7/31	high
324007	CentOS 9 : kernel-5.14.0-719.el9	Nessus	CentOS Local Security Checks	2026/7/1	2026/7/1	high
311718	Linux Distros Unpatched Vulnerability : CVE-2026-31739	Nessus	Misc.	2026/5/2	2026/7/31	high

检测

插件搜索

high

high

high

high

high

high

high

high

high