Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - netfilter：重新驗證橋接器連接埠 ebt_redirect_tg（） 解除參照 br_port_get_rcu（） 傳回而不進行 NULL 檢查，當原始攔截呼叫與 NFQUEUE 重新插入之間移除橋接器連接埠時，會導致核心錯誤。不過，僅僅 NULL 檢查是不夠的。正如 sashiko 評論指出的那樣，用戶空間不僅可以從橋接器中刪除端口，還可以將設備放置在不同的虛擬設備中，例如 macvlan。如果發生這種情況，我們必須丟棄封包，我們無法將其重新注入橋接路徑。切換到 _upper API，我們不需要橋接埠結構。此外，此修正保留了另一個錯誤：nfnetlink_log和nfnetlink_queue都使用過於激進的CONFIG_BRIDGE_NETFILTER，這會導致在橋接器系列中排入佇列時阻止某些記錄功能：
    NETFILTER_FAMILY_BRIDGE可以在舊CONFIG_BRIDGE_NETFILTER cruft 關閉時啟用。Fixes 標籤是一個共同的祖先，這總是被破壞的。（CVE-2026-53220）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - netfilter：重新验证桥接端口 ebt_redirect_tg（） 取消引用 br_port_get_rcu（） 返回但未进行 NULL 检查，从而在原始挂钩调用和 NFQUEUE 重新注入之间删除桥接端口时导致内核错误。但是，仅仅进行 NULL 检查是不够的。正如 sashiko review 所指出的，用户空间不仅会从桥接删除端口，还可以将设备放置到其他虚拟设备中，例如 macvlan。如果发生这种情况，我们必须丢弃数据包，无法将其重新注入桥接路径。切换到 _upper API，我们不需要桥接端口结构。此外，此补丁保持另一个缺陷不变：nfnetlink_log和nfnetlink_queue都过于激进地使用CONFIG_BRIDGE_NETFILTER，从而在桥接系列中排队时阻止某些日志记录功能：
    可在旧CONFIG_BRIDGE_NETFILTER cruft 关闭时启用NETFILTER_FAMILY_BRIDGE。修复标签是共同的祖先，但一直被破坏。（CVE-2026-53220）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - netfilter:NULL チェックなしでブリッジポート ebt_redirect_tg() デリファレンス br_port_get_rcu() を再検証します。これにより、元のフック呼び出しと NFQUEUE 再注入の間でブリッジポートが削除されると、カーネルパニックが発生します。ただし、単なる NULL チェックだけでは十分ではありません。sashiko review が指摘しているように、ユーザー空間は、ブリッジからポートを削除できるだけでなく、デバイスを別の仮想デバイス(macvlan など)に配置することもできます。これが発生した場合は、パケットをドロップする必要があります。ブリッジパスにパケットを再注入する方法はありません。_upper API に切り替え、ブリッジポート構造は不要です。また、この修正は、別のバグをそのまま維持しています:nfnetlink_log と nfnetlink_queue の両方が、あまりにもアグレッシブな CONFIG_BRIDGE_NETFILTER を使用しているため、ブリッジファミリーでキューイングするときに、特定のロギング機能が妨げられます:
    NETFILTER_FAMILY_BRIDGEは、古い CONFIG_BRIDGE_NETFILTER cruft がオフの状態で有効にできます。Fixes タグは共通の祖先であり、これは常に壊れていました。(CVE-2026-53220)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098723 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: revalidate bridge ports

    ebt_redirect_tg() dereferences br_port_get_rcu() return without a     NULL check, causing a kernel panic when the bridge port has been     removed between the original hook invocation and an NFQUEUE     reinject.

    A mere NULL check isn't sufficient, however.  As sashiko review     points out userspace can not only remove the port from the bridge,     it could also place the device in a different virtual device, e.g.
    macvlan.

    If this happens, we must drop the packet, there is no way for us to     reinject it into the bridge path.

    Switch to _upper API, we don't need the bridge port structure.
    Also, this fix keeps another bug intact:

    Both nfnetlink_log and nfnetlink_queue use CONFIG_BRIDGE_NETFILTER     too aggressive, which prevents certain logging features when queueing     in bridge family: NETFILTER_FAMILY_BRIDGE can be enabled while the old     CONFIG_BRIDGE_NETFILTER cruft is off.

    Fixes tag is a common ancestor, this was always broken.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102077 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: revalidate bridge ports

    ebt_redirect_tg() dereferences br_port_get_rcu() return without a     NULL check, causing a kernel panic when the bridge port has been     removed between the original hook invocation and an NFQUEUE     reinject.

    A mere NULL check isn't sufficient, however.  As sashiko review     points out userspace can not only remove the port from the bridge,     it could also place the device in a different virtual device, e.g.
    macvlan.

    If this happens, we must drop the packet, there is no way for us to     reinject it into the bridge path.

    Switch to _upper API, we don't need the bridge port structure.
    Also, this fix keeps another bug intact:

    Both nfnetlink_log and nfnetlink_queue use CONFIG_BRIDGE_NETFILTER     too aggressive, which prevents certain logging features when queueing     in bridge family: NETFILTER_FAMILY_BRIDGE can be enabled while the old     CONFIG_BRIDGE_NETFILTER cruft is off.

    Fixes tag is a common ancestor, this was always broken.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - netfilter: revalidate bridge ports ebt_redirect_tg() dereferences br_port_get_rcu() return without a NULL     check, causing a kernel panic when the bridge port has been removed between the original hook invocation     and an NFQUEUE reinject. A mere NULL check isn't sufficient, however. As sashiko review points out     userspace can not only remove the port from the bridge, it could also place the device in a different     virtual device, e.g. macvlan. If this happens, we must drop the packet, there is no way for us to reinject     it into the bridge path. Switch to _upper API, we don't need the bridge port structure. Also, this fix     keeps another bug intact: Both nfnetlink_log and nfnetlink_queue use CONFIG_BRIDGE_NETFILTER too     aggressive, which prevents certain logging features when queueing in bridge family:
    NETFILTER_FAMILY_BRIDGE can be enabled while the old CONFIG_BRIDGE_NETFILTER cruft is off. Fixes tag is a     common ancestor, this was always broken. (CVE-2026-53220)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
327383	Amazon Linux 2023：bpftool6.18、kernel6.18、kernel6.18-devel (ALAS2023-2026-1925)	Nessus	Amazon Linux Local Security Checks	2026/7/16	2026/7/31	high
323476	Linux Distros 未修補弱點：CVE-2026-53220	Nessus	Misc.	2026/6/28	2026/9/1	medium
323476	Linux Distros 未修补的漏洞：CVE-2026-53220	Nessus	Misc.	2026/6/28	2026/9/1	medium
328493	Amazon Linux 2023：bpftool6.12、kernel6.12、kernel6.12-devel （ALAS2023-2026-1968）	Nessus	Amazon Linux Local Security Checks	2026/7/20	2026/8/13	high
328493	Amazon Linux 2023：bpftool6.12、kernel6.12、kernel6.12-devel （ALAS2023-2026-1968）	Nessus	Amazon Linux Local Security Checks	2026/7/20	2026/8/13	high
327383	Amazon Linux 2023：bpftool6.18、kernel6.18、kernel6.18-devel (ALAS2023-2026-1925)	Nessus	Amazon Linux Local Security Checks	2026/7/16	2026/7/31	high
323476	Linux Distros のパッチ未適用の脆弱性: CVE-2026-53220	Nessus	Misc.	2026/6/28	2026/9/1	medium
327383	Amazon Linux 2023 : bpftool6.18、kernel6.18、kernel6.18-devel (ALAS2023-2026-1925)	Nessus	Amazon Linux Local Security Checks	2026/7/16	2026/7/31	high
328493	2023 Amazon Linux:bpftool6.12、kernel6.12、kernel6.12-devel(ALAS2023-2026-1968)	Nessus	Amazon Linux Local Security Checks	2026/7/20	2026/8/13	high
340482	Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098723)	Nessus	Unity Linux Local Security Checks	2026/8/26	2026/8/28	medium
327383	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1925)	Nessus	Amazon Linux Local Security Checks	2026/7/16	2026/7/31	high
338564	Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102077)	Nessus	Unity Linux Local Security Checks	2026/8/21	2026/8/21	medium
323476	Linux Distros Unpatched Vulnerability : CVE-2026-53220	Nessus	Misc.	2026/6/28	2026/9/1	medium
328493	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1968)	Nessus	Amazon Linux Local Security Checks	2026/7/20	2026/8/13	high

检测

插件搜索

high

medium

medium

high

high

high

medium

high

high

medium

high

medium

medium

high