Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - net/smc：修复 smc_llc_srv_add_link（） 中 LLC qentry 的释放后使用 smc_llc_srv_add_link（） add_llc指向队列条目：add_llc = &qentry->msg.add_link;smc_llc.c：1482 ...
    smc_llc_save_add_link_info（link_new、add_llc）;smc_llc.c：1494 smc_llc_flow_qentry_del（&lgr->llc_flow_lcl）;
    smc_llc.c：1495 ...u8 *llc_msg = smc_link_shared_v2_rxbuf（链接） ？（u8 *）lgr->wr_rx_buf_v2： （u8 *）add_llc;
    smc_llc.c：1504 smc_llc_save_add_link_rkeys（链接、link_new、llc_msg）;smc_llc.c：1506 smc_llc_flow_qentry_del（） kfree（） 条目，因此在无共享 v2 接收缓冲区的链接上，已释放传递给 smc_llc_save_add_link_rkeys（） 的指针。修复之前：提交分支始终使用 lgr->wr_rx_buf_v2，add_llc释放后未使用。通过 kasan、kasan_multi_shot 和链接强制在 rxe 上重现 == 1：该条目被max_recv_sge释放并被同一调用读取，释放帧是 smc_llc_srv_add_link（） 本身。[ 2.523161] 缺陷：KASAN：smc_llc_save_add_link_rkeys+0x333/0x350 中的 slab-after-free 使用 [ 2.523499] 任务 kworker/0:1/11 2.523789在地址 ffff8880052194de 读取大小为 2 [ ] [ 2.523862] CPU：0 UID：0 PID：11 Comm：kworker/0:1 未受感染 7.2.0-rc5-p0-g2c9dd296545d #35 PREEMPT（lazy） [ 2.523865] 硬件名称：QEMU Ubuntu 24.04 PC v2（i440FX + PIIX，arch_caps补丁，1996 年）、BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2.523866] 工作队列：smc_hs_wq smc_listen_work [ 2.523869] 调用跟踪： [ ] [ ] dump_stack_lvl+0x53/0x70 [2.523872] print_report+0xd0/0x630 [ 2.523874] ？ __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 2.523876] ？ smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.523878] kasan_report+0xce/0x100 [ 2.523879] ？ smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.523881] smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.523883] ？ smcr_buf_reg_lgr+0x2a4/0x660 [ 2.523885] smc_llc_srv_add_link+0xaa2/0x1e50 [ 2.523888] ？ _printk+0xba/0xf0 [ 2.523897] ？ __pfx_smc_llc_srv_add_link+0x10/0x10 [ 2.5238992.523871<TASK>2.523870] ?down_write+0xb0/0x130 [ 2.523903] ？
    __pfx_down_write+0x10/0x10 [ 2.523905] smc_listen_work+0x489e/0x4d00 [ 2.523907] ？ kmem_cache_free+0x1c6/0x3a0 [ 2.523911] ？ __pfx_smc_listen_work+0x10/0x10 [ 2.523913] ？ release_sock+0x148/0x1d0 [ 2.523915] ？ smc_tcp_listen_work+0xb4f/0xfc0 [ 2.523917] ？
    _raw_spin_lock_irq+0x80/0xe0 [ 2.523918] ？ __pfx__raw_spin_lock_irq+0x10/0x10 [ 2.523920] process_one_work+0x633/0x1030 [ 2.523922] ？ assign_work+0x11d/0x370 [ 2.523924] worker_thread+0x45b/0xd10 [ 2.523926] ？ __pfx_worker_thread+0x10/0x10 [ 2.523928] ？ __pfx_worker_thread+0x10/0x10 [ 2.523929] kthread+0x2c6/0x3b0 [ 2.523931] ？ recalc_sigpending+0x15c/0x1e0 [ 2.523934] ？ __pfx_kthread+0x10/0x10 [2.523935] ret_from_fork+0x36e/0x5a0 [ 2.523937] ？ __pfx_ret_from_fork+0x10/0x10 [ 2.523938] ？
    __switch_to+0x572/0xdd0 [ 2.523943] ？ __pfx_kthread+0x10/0x10 [ 2.523944] ret_from_fork_asm+0x1a/0x30 [2.523947] </TASK>2.523948[ ] 2.531253[ ] 按任务 48 分配： [ 2.531399] kasan_save_stack+0x33/0x60 [2.531570] kasan_save_track+0x14/0x30 [ 2.531737] __kasan_kmalloc+0x8f/0xa0 [ 2.531905]
    __kmalloc_cache_noprof+0x158/0x370 [ 2.532100] smc_llc_enqueue+0x72/0x560 [ 2.532268] smc_wr_rx_tasklet_fn+0x474/0xa80 [ 2.532491] tasklet_action_common+0x20f/0x8a0 [ 2.532714] handle_softirqs+0x18e/0x590 [ 2.532886] do_softirq+0x3b/0x60 [ 2.533036] __local_bh_enable_ip+0x61/0x70 [2.533221] __alloc_skb+0x732/0x890 [ 2.533384] rxe_init_packet+0x16b/0x4f0 [ 2.533567] prepare_ack_packet+0xb8/0x830 [ 2.533760] rxe_receiver+0x495/0x96e0 [ 2.533933] do_work+0x144/0x470 [ 2
    ---truncated--- (CVE-2026-80981)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - net/smc：修正 smc_llc_srv_add_link（） 中 LLC qentry 的釋放後使用 smc_llc_srv_add_link（） 保持add_llc指向佇列項目：add_llc = &qentry->msg.add_link;smc_llc.c：1482 ...
    smc_llc_save_add_link_info（link_new，add_llc）;smc_llc.c：1494 smc_llc_flow_qentry_del（&lgr->llc_flow_lcl）;
    smc_llc.c：1495 ...u8 *llc_msg = smc_link_shared_v2_rxbuf（連結） ？（u8 *）lgr->wr_rx_buf_v2 ： （u8 *）add_llc;
    smc_llc.c：1504 smc_llc_save_add_link_rkeys（連結，link_new，llc_msg）;smc_llc.c：1506 smc_llc_flow_qentry_del（） kfree（）s 項目，因此在沒有共用 v2 接收緩衝區的連結上，交給 smc_llc_save_add_link_rkeys（） 的指標已經釋放。在修正之前：提交該分支始終使用 lgr->wr_rx_buf_v2，並且在釋放後未使用add_llc。透過 rxe 在未修補的樹狀結構上重現，使用 KASAN、kasan_multi_shot 和連結強制max_recv_sge == 1：該條目被釋放並由同一調用讀取，並且釋放框架是 smc_llc_srv_add_link（） 本身。[ 2.523161] 錯誤：KASAN：smc_llc_save_add_link_rkeys+0x333/0x350 中的 slab-use-after-free [ 2.523499] 由任務 kworker/0:1/11 在 addr ffff8880052194de 讀取大小 2 [ 2.523789] [ 2.523862] CPU：0 UID：0 PID：11 Comm：kworker/0:1 未受污染 7.2.0-rc5-p0-g2c9dd296545d #35 搶佔（延遲） [ 2.523865] 硬體名稱：QEMU Ubuntu 24.04 PC v2 （i440FX + PIIX，arch_caps fix，1996），BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2.523866] 工作佇列：smc_hs_wq smc_listen_work [ 2.523869] 呼叫追蹤： [ ] [ ] dump_stack_lvl+0x53/0x70 [2.523872] print_report+0xd0/0x630 [ 2.523874] ？ __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 2.523876] smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.523878] kasan_report+0xce/0x100 [ 2.523879] ？ smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.523881] smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.523883] ？ smcr_buf_reg_lgr+0x2a4/0x660 [ 2.523885] smc_llc_srv_add_link+0xaa2/0x1e50 [ 2.523888] ？ _printk+0xba/0xf0 [ 2.523897] ？ __pfx_smc_llc_srv_add_link+0x10/0x10 [ 2.5238992.523871<TASK>2.523870] ?down_write+0xb0/0x130 [ 2.523903] ？
    __pfx_down_write+0x10/0x10 [ 2.523905] smc_listen_work+0x489e/0x4d00 [ 2.523907] ？ kmem_cache_free+0x1c6/0x3a0 [ 2.523911] ？ __pfx_smc_listen_work+0x10/0x10 [ 2.523913] ？ release_sock+0x148/0x1d0 [ 2.523915] ？ smc_tcp_listen_work+0xb4f/0xfc0 [ 2.523917] ？
    _raw_spin_lock_irq+0x80/0xe0 [ 2.523918] ？ __pfx__raw_spin_lock_irq+0x10/0x10 [ 2.523920] process_one_work+0x633/0x1030 [ 2.523922] ？ assign_work+0x11d/0x370 [ 2.523924] worker_thread+0x45b/0xd10 [ 2.523926] ？ __pfx_worker_thread+0x10/0x10 [ 2.523928] ？ __pfx_worker_thread+0x10/0x10 [ 2.523929] kthread+0x2c6/0x3b0 [ 2.523931] ？ recalc_sigpending+0x15c/0x1e0 [ 2.523934] ？ __pfx_kthread+0x10/0x10 [2.523935] ret_from_fork+0x36e/0x5a0 [ 2.523937] ？ __pfx_ret_from_fork+0x10/0x10 [ 2.523938] ？
    __switch_to+0x572/0xdd0 [ 2.523943] ？ __pfx_kthread+0x10/0x10 [ 2.523944] ret_from_fork_asm+0x1a/0x30 [2.523947] </TASK> [ 2.523948] 2.531253[ ] 任務 48 分配： [ 2.531399] kasan_save_stack+0x33/0x60 [2.531570] kasan_save_track+0x14/0x30 [ 2.531737] __kasan_kmalloc+0x8f/0xa0 [ 2.531905]
    __kmalloc_cache_noprof+0x158/0x370 [ 2.532100] smc_llc_enqueue+0x72/0x560 [ 2.532268] smc_wr_rx_tasklet_fn+0x474/0xa80 [ 2.532491] tasklet_action_common+0x20f/0x8a0 [ 2.532714] handle_softirqs+0x18e/0x590 [ 2.532886] do_softirq+0x3b/0x60 [ 2.533036] __local_bh_enable_ip+0x61/0x70 [2.533221 ] __alloc_skb+0x732/0x890 [ 2.533384] rxe_init_packet+0x16b/0x4f0 [ 2.533567] prepare_ack_packet+0xb8/0x830 [ 2.533760] rxe_receiver+0x495/0x96e0 [ 2.533933] do_work+0x144/0x470 [ 2
    ---truncated--- (CVE-2026-80981)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - net/smc:smc_llc_srv_add_link() の LLC qentry の use-after-free を修正します smc_llc_srv_add_link() がキューエントリを指し示し続けるadd_llc:add_llc = &qentry->msg.add_link;smc_llc.c:1482 ...
    smc_llc_save_add_link_info(link_new、add_llc);smc_llc.c:1494 smc_llc_flow_qentry_del(&lgr->llc_flow_lcl);
    smc_llc.c:1495 ...u8 *llc_msg = smc_link_shared_v2_rxbuf(link) ?(u8 *)lgr->wr_rx_buf_v2:(u8 *)add_llc;
    smc_llc.c:1504 smc_llc_save_add_link_rkeys(リンク、link_new、llc_msg);smc_llc.c:1506 smc_llc_flow_qentry_del() kfree()がエントリを読み取るため、共有v2受信バッファのないリンクでは、smc_llc_save_add_link_rkeys()に渡されたポインターは既に解放されています。修正前:そのブランチが常に lgr->wr_rx_buf_v2 を使用し、解放後 add_llc が使用されなかったことをコミット。rxe 上のパッチ未適用ツリー上で、KASAN、kasan_multi_shot、およびリンクが強制的に max_recv_sge == 1 で再現されます:エントリは解放され、同じ呼び出しで読み取られ、解放フレームは smc_llc_srv_add_link() 自体です。[ 2.523161] バグ:KASAN:smc_llc_save_add_link_rkeys+0x333/0x350 の slab-use-after-free [ 2.523499] addr ffff8880052194de におけるタスク kworker/0:1/11 によるサイズ 2 の読み取り [ 2.523789] [ 2.523862] CPU:0 UID:0 PID:11 通信:kworker/0:1 汚染されていません 7.2.0-rc5-p0-g2c9dd296545d #35 PREEMPT(lazy) [ 2.523865] ハードウェア名: QEMU Ubuntu 24.04 PC v2(i440FX + PIIX、arch_caps修正、1996)、BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2.523866] Workqueue: smc_hs_wq smc_listen_work [ 2.523869] 呼び出しトレース: [ 2.523870] <TASK> [ 2.523871] dump_stack_lvl+0x53/0x70 [2.523872] print_report+0xd0/0x630 [ 2.523874] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 2.523876] ? smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.523878] kasan_report+0xce/0x100 [ 2.523879] ? smc_llc_save_add_link_rkeys 0x333/0x350 [ 2.523881] smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.523883] ? smcr_buf_reg_lgr+0x2a4/0x660 [ 2.523885] smc_llc_srv_add_link+0xaa2/0x1e50 [ 2.523888] ? _printk+0xba/0xf0 [ 2.523897] ? __pfx_smc_llc_srv_add_link+0x10/0x10 [ 2.523899] ?down_write+0xb0/0x130 [ 2.523903] ?
    __pfx_down_write+0x10/0x10 [ 2.523905] smc_listen_work+0x489e/0x4d00 [ 2.523907] ? kmem_cache_free+0x1c6/0x3a0 [ 2.523911] ? __pfx_smc_listen_work+0x10/0x10 [ 2.523913] ? release_sock+0x148/0x1d0 [ 2.523915] ? smc_tcp_listen_work+0xb4f/0xfc0 [ 2.523917] ?
    _raw_spin_lock_irq+0x80/0xe0 [ 2.523918] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 2.523920] process_one_work+0x633/0x1030 [ 2.523922] ? assign_work+0x11d/0x370 [ 2.523924] worker_thread+0x45b/0xd10 [ 2.523926] ? __pfx_worker_thread+0x10/0x10 [ 2.523928] ? __pfx_worker_thread+0x10/0x10 [ 2.523929] kthread+0x2c6/0x3b0 [ 2.523931] ? recalc_sigpending+0x15c/0x1e0 [ 2.523934] ? __pfx_kthread+0x10/0x10 [2.523935] ret_from_fork+0x36e/0x5a0 [ 2.523937] ? __pfx_ret_from_fork+0x10/0x10 [ 2.523938] ?
    __switch_to+0x572/0xdd0 [ 2.523943] ? __pfx_kthread+0x10/0x10 [ 2.523944] ret_from_fork_asm+0x1a/0x30 [2.523947] </TASK> [ 2.523948] [ 2.531253] タスク 48 により割り当てられる: [ 2.531399] kasan_save_stack+0x33/0x60 [2.531570] kasan_save_track+0x14/0x30 [ 2.531737] __kasan_kmalloc+0x8f/0xa0 [ 2.531905]
    __kmalloc_cache_noprof+0x158/0x370 [ 2.532100] smc_llc_enqueue+0x72/0x560 [ 2.532268] smc_wr_rx_tasklet_fn+0x474/0xa80 [ 2.532491] tasklet_action_common+0x20f/0x8a0 [ 2.532714] handle_softirqs+0x18e/0x590 [ 2.532886] do_softirq+0x3b/0x60 [ 2.533036 ] __local_bh_enable_ip+0x61/0x70 [2.533221] __alloc_skb+0x732/0x890 [ 2.533384] rxe_init_packet+0x16b/0x4f0 [ 2.533567] prepare_ack_packet+0xb8/0x830 [ 2.533760] rxe_receiver+0x495/0x96e0 [ 2.533933] do_work+0x144/0x470 [ 2
    ---truncated--- (CVE-2026-80981)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99133 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)

    * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)

    * kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)

    * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)

    * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    * kernel: s390/vfio_ccw: Cancel existing workqueues (CVE-2026-80553)

    * kernel: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (CVE-2026-80571)

    * kernel: s390/qeth: validate user buffer length in SNMP and ARP query ioctls (CVE-2026-80584)

    * kernel: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (CVE-2026-80981)

    * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)

    * kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)

    * kernel: i3c: master: svc: bound IBI payload to the requested max_payload_len (CVE-2026-80951)

    * kernel: s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects     (CVE-2026-89956)

    * kernel: ALSA: seq: midi: Serialize input teardown with event_input (CVE-2026-90207)

    * kernel: smb: client: validate absolute native symlink targets before NT fixups (CVE-2026-98318)

    * kernel: kernel: Denial of Service via unvalidated task in iSCSI management responses (CVE-2026-99152)

    * kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU (CVE-2026-99153)

    Bug Fix(es) and Enhancement(s):

    * mpls test multi_path fails on 10.3 CTC2 compose (JIRA:RHEL-222766)

    * RHEL10.0 - kernel: CPU hotplug unsupported by CPUMF [rhel-10.3.z] (JIRA:RHEL-270889)

    * Backport 6785011f8b16 (ipv4: validate checksum_start before completing checksum) [rhel-10.3.z]     (JIRA:RHEL-280591)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:99133 advisory.

    * kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)

    * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)

    * kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)

    * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)

    * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    * kernel: s390/vfio_ccw: Cancel existing workqueues (CVE-2026-80553)

    * kernel: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (CVE-2026-80571)

    * kernel: s390/qeth: validate user buffer length in SNMP and ARP query ioctls (CVE-2026-80584)

    * kernel: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (CVE-2026-80981)

    * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)

    * kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)

    * kernel: i3c: master: svc: bound IBI payload to the requested max_payload_len (CVE-2026-80951)

    * kernel: s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects     (CVE-2026-89956)

    * kernel: ALSA: seq: midi: Serialize input teardown with event_input (CVE-2026-90207)

    * kernel: smb: client: validate absolute native symlink targets before NT fixups (CVE-2026-98318)

    * kernel: kernel: Denial of Service via unvalidated task in iSCSI management responses (CVE-2026-99152)

    * kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU (CVE-2026-99153)

    Bug Fix(es) and Enhancement(s):

    * mpls test multi_path fails on 10.3 CTC2 compose (JIRA:Rocky Linux-222766)

    * Rocky Linux10.0 - kernel: CPU hotplug unsupported by CPUMF [rhel-10.3.z] (JIRA:Rocky Linux-270889)

    * Backport 6785011f8b16 (ipv4: validate checksum_start before completing checksum) [rhel-10.3.z]     (JIRA:Rocky Linux-280591)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:99135 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

    * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)

    * kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)

    * kernel: s390/zcrypt: Validate length for CCA AES cipher key requests (CVE-2026-68452)

    * kernel: s390/zcrypt: Validate length for CCA ECC private key requests (CVE-2026-68451)

    * kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222)

    * kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221)

    * kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (CVE-2026-74385)

    * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)

    * kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)

    * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)

    * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    * kernel: s390/vfio_ccw: Cancel existing workqueues (CVE-2026-80553)

    * kernel: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (CVE-2026-80571)

    * kernel: s390/qeth: validate user buffer length in SNMP and ARP query ioctls (CVE-2026-80584)

    * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)

    * kernel: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (CVE-2026-80981)

    * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)

    * kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)

    * kernel: s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects     (CVE-2026-89956)

    * kernel: ALSA: seq: midi: Serialize input teardown with event_input (CVE-2026-90207)

    * kernel: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (CVE-2026-98116)

    * kernel: smb: client: validate absolute native symlink targets before NT fixups (CVE-2026-98318)

    * kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999)

    * kernel: net/sched: act_ct: fix helper UAF due to extensions realloc (CVE-2026-98442)

    * kernel: ALSA: ua101: reject mismatched capture/playback packet sizes (CVE-2026-98741)

    * kernel: net/smc: protect clcsock lifetime in smc_getname (CVE-2026-99032)

    * kernel: kernel: Denial of Service via unvalidated task in iSCSI management responses (CVE-2026-99152)

    * kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU (CVE-2026-99153)

    Bug Fix(es) and Enhancement(s):

    * [RHEL9.9z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:RHEL-255218)

    * RT scheduler livelock: migrate-disabled task at pushable-list head causes repeated RT push/stopper     retries, starving a critical RT task (remaining issue after CVE-2026-45919 fix in 94894c9c477e)     [rhel-9.9.z] (JIRA:RHEL-256280)

    * MADVISE i/o size in RHEL 9 additionally limited by read_ahead_kb - Was addressed in RHEL8 via RHEL-22476     [rhel-9.9.z] (JIRA:RHEL-259532)

    * try_charge_memcg() refactor in kernel 5.14.0-687.36.1 causes premature memcg OOM with GiB of clean page     cache present [rhel-9.9.z] (JIRA:RHEL-269061)

    * RHEL9.4 - kernel: CPU hotplug unsupported by CPUMF [rhel-9.9.z] (JIRA:RHEL-270893)

    * Accel-DSA: dmaengine: idxd: kernel oops on unbind [rhel-9.9.z] (JIRA:RHEL-274411)

    * af_unix: Fix peek then tail dereference UAF in unix_stream_data_wait() [rhel-9.9] (JIRA:RHEL-275410)

    * Kernel panic after stopping retis capture  [rhel-9.9.z] (JIRA:RHEL-275457)

    * Hard lockup experienced with repro from RHEL-282072 [rhel-9.9.z] (JIRA:RHEL-290031)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:99135 advisory.

    * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

    * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)

    * kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)

    * kernel: s390/zcrypt: Validate length for CCA AES cipher key requests (CVE-2026-68452)

    * kernel: s390/zcrypt: Validate length for CCA ECC private key requests (CVE-2026-68451)

    * kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222)

    * kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221)

    * kernel: nvmet-tcp: check return value of nvmet_tcp_set_queue_sock (CVE-2026-74385)

    * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)

    * kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)

    * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)

    * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)

    * kernel: s390/vfio_ccw: Cancel existing workqueues (CVE-2026-80553)

    * kernel: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (CVE-2026-80571)

    * kernel: s390/qeth: validate user buffer length in SNMP and ARP query ioctls (CVE-2026-80584)

    * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)

    * kernel: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (CVE-2026-80981)

    * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)

    * kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)

    * kernel: s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects     (CVE-2026-89956)

    * kernel: ALSA: seq: midi: Serialize input teardown with event_input (CVE-2026-90207)

    * kernel: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (CVE-2026-98116)

    * kernel: smb: client: validate absolute native symlink targets before NT fixups (CVE-2026-98318)

    * kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999)

    * kernel: net/sched: act_ct: fix helper UAF due to extensions realloc (CVE-2026-98442)

    * kernel: ALSA: ua101: reject mismatched capture/playback packet sizes (CVE-2026-98741)

    * kernel: net/smc: protect clcsock lifetime in smc_getname (CVE-2026-99032)

    * kernel: kernel: Denial of Service via unvalidated task in iSCSI management responses (CVE-2026-99152)

    * kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU (CVE-2026-99153)

    Bug Fix(es) and Enhancement(s):

    * [Rocky Linux9.9z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:Rocky     Linux-255218)

    * RT scheduler livelock: migrate-disabled task at pushable-list head causes repeated RT push/stopper     retries, starving a critical RT task (remaining issue after CVE-2026-45919 fix in 94894c9c477e)     [rhel-9.9.z] (JIRA:Rocky Linux-256280)

    * MADVISE i/o size in Rocky Linux 9 additionally limited by read_ahead_kb - Was addressed in Rocky Linux8     via Rocky Linux-22476 [rhel-9.9.z] (JIRA:Rocky Linux-259532)

    * try_charge_memcg() refactor in kernel 5.14.0-687.36.1 causes premature memcg OOM with GiB of clean page     cache present [rhel-9.9.z] (JIRA:Rocky Linux-269061)

    * Rocky Linux9.4 - kernel: CPU hotplug unsupported by CPUMF [rhel-9.9.z] (JIRA:Rocky Linux-270893)

    * Accel-DSA: dmaengine: idxd: kernel oops on unbind [rhel-9.9.z] (JIRA:Rocky Linux-274411)

    * af_unix: Fix peek then tail dereference UAF in unix_stream_data_wait() [rhel-9.9] (JIRA:Rocky     Linux-275410)

    * Kernel panic after stopping retis capture  [rhel-9.9.z] (JIRA:Rocky Linux-275457)

    * Hard lockup experienced with repro from Rocky Linux-282072 [rhel-9.9.z] (JIRA:Rocky Linux-290031)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free of the LLC     qentry in smc_llc_srv_add_link() smc_llc_srv_add_link() keeps add_llc pointing into the queue entry:
    add_llc = &qentry->msg.add_link; smc_llc.c:1482 ... smc_llc_save_add_link_info(link_new, add_llc);
    smc_llc.c:1494 smc_llc_flow_qentry_del(&lgr->llc_flow_lcl); smc_llc.c:1495 ... u8 *llc_msg =     smc_link_shared_v2_rxbuf(link) ? (u8 *)lgr->wr_rx_buf_v2 : (u8 *)add_llc; smc_llc.c:1504     smc_llc_save_add_link_rkeys(link, link_new, llc_msg); smc_llc.c:1506 smc_llc_flow_qentry_del() kfree()s     the entry, so on a link without a shared v2 receive buffer the pointer handed to     smc_llc_save_add_link_rkeys() is already freed. Before the Fixes: commit that branch always used     lgr->wr_rx_buf_v2 and add_llc was not used after the free. Reproduced on an unpatched tree over rxe, with     KASAN, kasan_multi_shot and a link forced to max_recv_sge == 1: the entry is freed and read by the same     call, and the freeing frame is smc_llc_srv_add_link() itself. [ 2.523161] BUG: KASAN: slab-use-after-free     in smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.523499] Read of size 2 at addr ffff8880052194de by task     kworker/0:1/11 [ 2.523789] [ 2.523862] CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted     7.2.0-rc5-p0-g2c9dd296545d #35 PREEMPT(lazy) [ 2.523865] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX +     PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2.523866] Workqueue: smc_hs_wq     smc_listen_work [ 2.523869] Call Trace: [ 2.523870] <TASK> [ 2.523871] dump_stack_lvl+0x53/0x70 [     2.523872] print_report+0xd0/0x630 [ 2.523874] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 2.523876] ?     smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.523878] kasan_report+0xce/0x100 [ 2.523879] ?     smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.523881] smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.523883] ?     smcr_buf_reg_lgr+0x2a4/0x660 [ 2.523885] smc_llc_srv_add_link+0xaa2/0x1e50 [ 2.523888] ? _printk+0xba/0xf0     [ 2.523897] ? __pfx_smc_llc_srv_add_link+0x10/0x10 [ 2.523899] ? down_write+0xb0/0x130 [ 2.523903] ?
    __pfx_down_write+0x10/0x10 [ 2.523905] smc_listen_work+0x489e/0x4d00 [ 2.523907] ?     kmem_cache_free+0x1c6/0x3a0 [ 2.523911] ? __pfx_smc_listen_work+0x10/0x10 [ 2.523913] ?     release_sock+0x148/0x1d0 [ 2.523915] ? smc_tcp_listen_work+0xb4f/0xfc0 [ 2.523917] ?
    _raw_spin_lock_irq+0x80/0xe0 [ 2.523918] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 2.523920]     process_one_work+0x633/0x1030 [ 2.523922] ? assign_work+0x11d/0x370 [ 2.523924] worker_thread+0x45b/0xd10     [ 2.523926] ? __pfx_worker_thread+0x10/0x10 [ 2.523928] ? __pfx_worker_thread+0x10/0x10 [ 2.523929]     kthread+0x2c6/0x3b0 [ 2.523931] ? recalc_sigpending+0x15c/0x1e0 [ 2.523934] ? __pfx_kthread+0x10/0x10 [     2.523935] ret_from_fork+0x36e/0x5a0 [ 2.523937] ? __pfx_ret_from_fork+0x10/0x10 [ 2.523938] ?
    __switch_to+0x572/0xdd0 [ 2.523943] ? __pfx_kthread+0x10/0x10 [ 2.523944] ret_from_fork_asm+0x1a/0x30 [     2.523947] </TASK> [ 2.523948] [ 2.531253] Allocated by task 48: [ 2.531399] kasan_save_stack+0x33/0x60 [     2.531570] kasan_save_track+0x14/0x30 [ 2.531737] __kasan_kmalloc+0x8f/0xa0 [ 2.531905]
    __kmalloc_cache_noprof+0x158/0x370 [ 2.532100] smc_llc_enqueue+0x72/0x560 [ 2.532268]     smc_wr_rx_tasklet_fn+0x474/0xa80 [ 2.532491] tasklet_action_common+0x20f/0x8a0 [ 2.532714]     handle_softirqs+0x18e/0x590 [ 2.532886] do_softirq+0x3b/0x60 [ 2.533036] __local_bh_enable_ip+0x61/0x70 [     2.533221] __alloc_skb+0x732/0x890 [ 2.533384] rxe_init_packet+0x16b/0x4f0 [ 2.533567]     prepare_ack_packet+0xb8/0x830 [ 2.533760] rxe_receiver+0x495/0x96e0 [ 2.533933] do_work+0x144/0x470 [ 2
    ---truncated--- (CVE-2026-80981)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
345334	Linux Distros 未修补的漏洞：CVE-2026-80981	Nessus	Misc.	2026/9/12	2026/11/13	critical
345334	Linux Distros 未修補弱點：CVE-2026-80981	Nessus	Misc.	2026/9/12	2026/11/13	critical
345334	Linux Distros のパッチ未適用の脆弱性: CVE-2026-80981	Nessus	Misc.	2026/9/12	2026/11/13	critical
379359	RHEL 10 : kernel (RHSA-2026:99133)	Nessus	Red Hat Local Security Checks	2026/11/11	2026/11/11	critical
380194	RockyLinux 10 : kernel (RLSA-2026:99133)	Nessus	Rocky Linux Local Security Checks	2026/11/13	2026/11/13	critical
376443	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel vulnerabilities (USN-8959-1)	Nessus	Ubuntu Local Security Checks	2026/11/5	2026/11/5	high
379392	RHEL 9 : kernel (RHSA-2026:99135)	Nessus	Red Hat Local Security Checks	2026/11/12	2026/11/12	medium
380699	RockyLinux 9 : kernel (RLSA-2026:99135)	Nessus	Rocky Linux Local Security Checks	2026/11/13	2026/11/13	medium
345334	Linux Distros Unpatched Vulnerability : CVE-2026-80981	Nessus	Misc.	2026/9/12	2026/11/13	critical

检测

插件搜索

critical

critical

critical

critical

critical

high

medium

medium

critical