AlmaLinux 9.6 [TuxCare] 安全性更新：kernel / kernel-abi-stablelists / kernel-core / etc 多個弱點 （ALMALINUX9.6：CLSA-2026：1780052998）
high Nessus Plugin ID 351722
語言:
概要
AlmaLinux 主機缺少一或多個安全性更新。說明
AlmaLinux 9.6 主機已安裝的套件會受到 TuxCare ALMALINUX9.6：CLSA-2026：1780052998 公告中提及的多個弱點影響。- 已解決 Linux 核心中的下列弱點：can: isotp: fix potential CAN frame reception race in isotp_rcv() When receiving a CAN frame the current code logic does not consider concurrently receiving processes which do not show up in real world usage. Ziyang Xuan writes: The following syz problem is one of the scenarios. so->rx.len is changed by isotp_rcv_ff() during isotp_rcv_cf(), so->rx.len equals 0 before alloc_skb() and equals 4096 after alloc_skb(). That will trigger skb_over_panic() in skb_put(). ======================================================= CPU: 1 PID:
19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc8-syzkaller #0 RIP: 0010:skb_panic+0x16c/0x16e net/core/skbuff.c:113 Call Trace: <TASK> skb_over_panic net/core/skbuff.c:118 [inline] skb_put.cold+0x24/0x24 net/core/skbuff.c:1990 isotp_rcv_cf net/can/isotp.c:570 [inline] isotp_rcv+0xa38/0x1e30 net/can/isotp.c:668 deliver net/can/af_can.c:574 [inline] can_rcv_filter+0x445/0x8d0 net/can/af_can.c:635 can_receive+0x31d/0x580 net/can/af_can.c:665 can_rcv+0x120/0x1c0 net/can/af_can.c:696 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5465
__netif_receive_skb+0x24/0x1b0 net/core/dev.c:5579 Therefore we make sure the state changes and data structures stay consistent at CAN frame reception time by adding a spin_lock in isotp_rcv(). This fixes the issue reported by syzkaller but does not affect real world operation. (CVE-2022-48830)
- 已解決 Linux 核心中的下列弱點：ceph: fix deadlock or deadcode of misusing dget() The lock order is incorrect between denty and its parent, we should always make sure that the parent get the lock first. But since this deadcode is never used and the parent dir will always be set from the callers, let's just remove it. (CVE-2023-52583)
- 已解決 Linux 核心中的下列弱點：trace_events_hist: add check for return value of 'create_hist_field' Function 'create_hist_field' is called recursively at trace_events_hist.c:1954 and can return NULL-value that's why we have to check it to avoid null pointer dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2023-53005)
- 已解決 Linux 核心中的下列弱點：netfilter: x_tables: fix percpu counter block leak on error path when creating new netns Here is the stack where we allocate percpu counter block: +-< __alloc_percpu +-< xt_percpu_counter_alloc +-< find_check_entry # {arp,ip,ip6}_tables.c +-< translate_table And it can be leaked on this code path: +-> ip6t_register_table +-> translate_table # allocates percpu counter block +-> xt_register_table # fails there is no freeing of the counter block on xt_register_table fail. Note: xt_percpu_counter_free should be called to free it like we do in do_replace through cleanup_entry helper (or in __ip6t_unregister_table). Probability of hitting this error path is low AFAICS (xt_register_table can only return ENOMEM here, as it is not replacing anything, as we are creating new netns, and it is hard to imagine that all previous allocations succeeded and after that one in xt_register_table failed). But it's worth fixing even the rare leak. (CVE-2023-53200)
- 已解決 Linux 核心中的下列弱點：spi: imx: Don't skip cleanup in remove's error path Returning early in a platform driver's remove callback is wrong. In this case the dma resources are not released in the error path. this is never retried later and so this is a permanent leak.
To fix this, only skip hardware disabling if waking the device fails. (CVE-2023-53225)
請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。
解決方案
根據 TuxCare 公告 ALMALINUX9.6：CLSA-2026：1780052998 中的指引更新受影響的套件。另請參閱
Plugin 詳細資訊
嚴重性: High
ID: 351722
檔案名稱: tuxcare_alma_linux_9.6_CLSA-2026-1780052998.nasl
版本: 1.1
類型: Local
已發布: 2026/9/30
已更新: 2026/9/30
支援的感應器: Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
風險資訊
VPR
風險因素: High
分數: 7.9
百分位數: 99.35
Vendor
Vendor Severity: Important
CVSS v2
風險因素: High
基本分數: 8.3
時間性分數: 7.2
媒介: CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C
CVSS 評分資料來源: CVE-2026-23395
CVSS v3
風險因素: High
基本分數: 8.8
時間性分數: 8.4
媒介: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
時間媒介: CVSS:3.0/E:H/RL:O/RC:C
弱點資訊
必要的 KB 項目: Host/local_checks_enabled, Host/cpu, Host/AlmaLinux/release, Host/AlmaLinux/rpm-list, Host/OS/extended-third-party
可被惡意程式利用: true
可輕鬆利用: Exploits are available
修補程式發佈日期: 2026/5/29
弱點發布日期: 2021/7/21
參考資訊
CVE: CVE-2022-48830, CVE-2023-52583, CVE-2023-53005, CVE-2023-53200, CVE-2023-53225, CVE-2023-53234, CVE-2023-53279, CVE-2023-53295, CVE-2023-53344, CVE-2023-53368, CVE-2023-53375, CVE-2023-53411, CVE-2023-53423, CVE-2023-53450, CVE-2023-53480, CVE-2023-53481, CVE-2023-53535, CVE-2023-53667, CVE-2024-38601, CVE-2024-43098, CVE-2024-45003, CVE-2024-46715, CVE-2024-46791, CVE-2024-56569, CVE-2024-56584, CVE-2024-56587, CVE-2024-56709, CVE-2024-56720, CVE-2024-56756, CVE-2024-57977, CVE-2025-21638, CVE-2025-21639, CVE-2025-21640, CVE-2025-21653, CVE-2025-21707, CVE-2025-21732, CVE-2025-21992, CVE-2025-22062, CVE-2025-23141, CVE-2025-23155, CVE-2025-23161, CVE-2025-37788, CVE-2025-37807, CVE-2025-37836, CVE-2025-37878, CVE-2025-37884, CVE-2025-37954, CVE-2025-37961, CVE-2025-37989, CVE-2025-38039, CVE-2025-38057, CVE-2025-38097, CVE-2025-38147, CVE-2025-38192, CVE-2025-38321, CVE-2025-38335, CVE-2025-38393, CVE-2025-38412, CVE-2025-38438, CVE-2025-38466, CVE-2025-38544, CVE-2025-38565, CVE-2025-38709, CVE-2025-39673, CVE-2025-39681, CVE-2025-39748, CVE-2025-39754, CVE-2025-39763, CVE-2025-39764, CVE-2025-39850, CVE-2025-39931, CVE-2025-40040, CVE-2025-40149, CVE-2025-71094, CVE-2025-71098, CVE-2025-71111, CVE-2025-71131, CVE-2025-71151, CVE-2025-71161, CVE-2026-22997, CVE-2026-23011, CVE-2026-23071, CVE-2026-23101, CVE-2026-23108, CVE-2026-23119, CVE-2026-23120, CVE-2026-23136, CVE-2026-23164, CVE-2026-23171, CVE-2026-23270, CVE-2026-23318, CVE-2026-23374, CVE-2026-23395, CVE-2026-31402, CVE-2026-31485, CVE-2026-31492, CVE-2026-31495, CVE-2026-31555, CVE-2026-31575, CVE-2026-31759, CVE-2026-31778, CVE-2026-46243
CLSA: 2026:1780052998