AlmaLinux 9.2 [TuxCare] 安全性更新：bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc 多個弱點 （ALMALINUX9.2：CLSA-2026：1791741836）
critical Nessus Plugin ID 364688
語言:
概要
AlmaLinux 主機缺少一個或多個安全性更新。說明
AlmaLinux 9.2 主機已安裝的套件會受到 TuxCare ALMALINUX9.2：CLSA-2026：1791741836 公告中提及的多個弱點影響。- 已解決 Linux 核心中的下列弱點：vhost: fix hung thread due to erroneous iotlb entries In vhost_iotlb_add_range_ctx(), range size can overflow to 0 when start is 0 and last is ULONG_MAX. One instance where it can happen is when userspace sends an IOTLB message with iova=size=uaddr=0 (vhost_process_iotlb_msg). So, an entry with size = 0, start = 0, last = ULONG_MAX ends up in the iotlb. Next time a packet is sent, iotlb_access_ok() loops indefinitely due to that erroneous entry. Call Trace: <TASK> iotlb_access_ok+0x21b/0x3e0 drivers/vhost/vhost.c:1340 vq_meta_prefetch+0xbc/0x280 drivers/vhost/vhost.c:1366 vhost_transport_do_send_pkt+0xe0/0xfd0 drivers/vhost/vsock.c:104 vhost_worker+0x23d/0x3d0 drivers/vhost/vhost.c:372 kthread+0x2e9/0x3a0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 </TASK> Reported by syzbot at:
https://syzkaller.appspot.com/bug?extid=0abd373e2e50d704db87 To fix this, do two things: 1. Return -EINVAL in vhost_chr_write_iter() when userspace asks to map a range with size 0. 2. Fix vhost_iotlb_add_range_ctx() to handle the range [0, ULONG_MAX] by splitting it into two entries.
(CVE-2022-48862)
- 已解決 Linux 核心中的下列弱點：net: hns3: add vlan list lock to protect vlan list When adding port base VLAN, vf VLAN need to remove from HW and modify the vlan state in vf VLAN list as false. If the periodicity task is freeing the same node, it may cause use after free error. This patch adds a vlan list lock to protect the vlan list. (CVE-2022-49182)
- 已解決 Linux 核心中的下列弱點：perf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and throttling amd_pmu_enable_all() does: if (!test_bit(idx, cpuc->active_mask)) continue; amd_pmu_enable_event(cpuc->events[idx]); A perf NMI of another event can come between these two steps. Perf NMI handler internally disables and enables _all_ events, including the one which nmi-intercepted amd_pmu_enable_all() was in process of enabling. If that unintentionally enabled event has very low sampling period and causes immediate successive NMI, causing the event to be throttled, cpuc->events[idx] and cpuc->active_mask gets cleared by x86_pmu_stop(). This will result in amd_pmu_enable_event() getting called with event=NULL when amd_pmu_enable_all() resumes after handling the NMIs. This causes a kernel crash: BUG: kernel NULL pointer dereference, address: 0000000000000198 #PF:
supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page [...] Call Trace: <TASK> amd_pmu_enable_all+0x68/0xb0 ctx_resched+0xd9/0x150 event_function+0xb8/0x130 ? hrtimer_start_range_ns+0x141/0x4a0 ? perf_duration_warn+0x30/0x30 remote_function+0x4d/0x60
__flush_smp_call_function_queue+0xc4/0x500 flush_smp_call_function_queue+0x11d/0x1b0 do_idle+0x18f/0x2d0 cpu_startup_entry+0x19/0x20 start_secondary+0x121/0x160 secondary_startup_64_no_verify+0xe5/0xeb </TASK> amd_pmu_disable_all()/amd_pmu_enable_all() calls inside perf NMI handler were recently added as part of BRS enablement but I'm not sure whether we really need them. We can just disable BRS in the beginning and enable it back while returning from NMI. This will solve the issue by not enabling those events whose active_masks are set but are not yet enabled in hw pmu. (CVE-2022-49781)
- 已解決 Linux 核心中的下列弱點：blk-iolatency: Fix memory leak on add_disk() failures When a gendisk is successfully initialized but add_disk() fails such as when a loop device has invalid number of minor device numbers specified, blkcg_init_disk() is called during init and then blkcg_exit_disk() during error handling. Unfortunately, iolatency gets initialized in the former but doesn't get cleaned up in the latter. This is because, in non-error cases, the cleanup is performed by del_gendisk() calling rq_qos_exit(), the assumption being that rq_qos policies, iolatency being one of them, can only be activated once the disk is fully registered and visible. That assumption is true for wbt and iocost, but not so for iolatency as it gets initialized before add_disk() is called. It is desirable to lazy-init rq_qos policies because they are optional features and add to hot path overhead once initialized - each IO has to walk all the registered rq_qos policies. So, we want to switch iolatency to lazy init too. However, that's a bigger change. As a fix for the immediate problem, let's just add an extra call to rq_qos_exit() in blkcg_exit_disk(). This is safe because duplicate calls to rq_qos_exit() become noop's. (CVE-2022-50550)
- 已解決 Linux 核心中的下列弱點：usb: roles: fix NULL pointer issue when put module's reference In current design, usb role class driver will get usb_role_switch parent's module reference after the user get usb_role_switch device and put the reference after the user put the usb_role_switch device. However, the parent device of usb_role_switch may be removed before the user put the usb_role_switch. If so, then, NULL pointer issue will be met when the user put the parent module's reference. This will save the module pointer in structure of usb_role_switch. Then, we don't need to find module by iterating long relations. (CVE-2024-26747)
請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。
解決方案
根據 TuxCare 公告 ALMALINUX9.2：CLSA-2026：1791741836 中的指引更新受影響的套件。另請參閱
Plugin 詳細資訊
嚴重性: Critical
ID: 364688
檔案名稱: tuxcare_alma_linux_9.2_CLSA-2026-1791741836.nasl
版本: 1.2
類型: Local
已發布: 2026/10/12
已更新: 2026/10/13
支援的感應器: Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
風險資訊
VPR
風險因素: Critical
分數: 9.4
百分位數: 99.82
Vendor
Vendor Severity: Critical
CVSS v2
風險因素: Critical
基本分數: 10
時間性分數: 8.7
媒介: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS 評分資料來源: CVE-2025-39682
CVSS v3
風險因素: Critical
基本分數: 9.8
時間性分數: 9.4
媒介: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
時間媒介: CVSS:3.0/E:H/RL:O/RC:C
弱點資訊
必要的 KB 項目: Host/local_checks_enabled, Host/cpu, Host/AlmaLinux/release, Host/AlmaLinux/rpm-list, Host/OS/extended-third-party
可被惡意程式利用: true
可輕鬆利用: Exploits are available
修補程式發佈日期: 2026/10/11
弱點發布日期: 2021/7/21
CISA 已知遭惡意利用弱點到期日: 2025/4/30, 2026/9/21
參考資訊
CVE: CVE-2022-3542, CVE-2022-48862, CVE-2022-49182, CVE-2022-49781, CVE-2022-50550, CVE-2024-26747, CVE-2024-26830, CVE-2024-49891, CVE-2024-49940, CVE-2024-50280, CVE-2024-53197, CVE-2024-55881, CVE-2024-56770, CVE-2025-21938, CVE-2025-21978, CVE-2025-22097, CVE-2025-22125, CVE-2025-37889, CVE-2025-38170, CVE-2025-38455, CVE-2025-38465, CVE-2025-39682, CVE-2025-39964, CVE-2025-39969, CVE-2025-39980, CVE-2025-40019, CVE-2025-40026, CVE-2025-40049, CVE-2025-40103, CVE-2025-40115, CVE-2025-40173, CVE-2025-40178, CVE-2025-40198, CVE-2025-40231, CVE-2025-40252, CVE-2025-40254, CVE-2025-68241, CVE-2025-68264, CVE-2025-68740, CVE-2025-68764, CVE-2026-100075, CVE-2026-23310, CVE-2026-23475, CVE-2026-31446, CVE-2026-31505, CVE-2026-31570, CVE-2026-31678, CVE-2026-31680, CVE-2026-43253, CVE-2026-43309, CVE-2026-43333, CVE-2026-43405, CVE-2026-43428, CVE-2026-46199, CVE-2026-46230, CVE-2026-46327, CVE-2026-52910, CVE-2026-52961, CVE-2026-52984, CVE-2026-53060, CVE-2026-53069, CVE-2026-53221, CVE-2026-53266, CVE-2026-63919, CVE-2026-63946, CVE-2026-63971, CVE-2026-64034, CVE-2026-64097, CVE-2026-64319, CVE-2026-64379, CVE-2026-64438, CVE-2026-64545, CVE-2026-68123, CVE-2026-68162, CVE-2026-68201, CVE-2026-68236, CVE-2026-68273, CVE-2026-68288, CVE-2026-68362, CVE-2026-68436, CVE-2026-68446, CVE-2026-72098, CVE-2026-72129, CVE-2026-72130, CVE-2026-72243, CVE-2026-72261, CVE-2026-74287, CVE-2026-74469, CVE-2026-74480, CVE-2026-74635, CVE-2026-74637, CVE-2026-74657, CVE-2026-74671, CVE-2026-74680, CVE-2026-74701, CVE-2026-74717, CVE-2026-74726, CVE-2026-74736, CVE-2026-74743, CVE-2026-74748, CVE-2026-80534, CVE-2026-80574, CVE-2026-80589, CVE-2026-80726, CVE-2026-80844, CVE-2026-89643, CVE-2026-89682, CVE-2026-89711, CVE-2026-89817, CVE-2026-89846, CVE-2026-90067, CVE-2026-90228, CVE-2026-90413, CVE-2026-93185, CVE-2026-93228, CVE-2026-97417, CVE-2026-97517, CVE-2026-97555, CVE-2026-97964, CVE-2026-97991, CVE-2026-98016, CVE-2026-98031, CVE-2026-98075, CVE-2026-98154, CVE-2026-98161, CVE-2026-98374
CLSA: 2026:1791741836