Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - wifi： mac80211：丟棄過大的片段以避免extra_len溢位 在 ieee80211_rx_h_defragment（） 中，隨著後續片段的到達，片段負載會累積到 entry->extra_len： entry->extra_len += rx->skb->len;當最終片段到達時，頭部片段會出列，並使用 entry->extra_len 呼叫 pskb_expand_head（），以確保在複製之前為所有排入佇列的片段提供足夠的尾部空間： if （skb_tailroom（rx->skb） < entry->extra_len） { if （unlikely（pskb_expand_head（rx->skb， 0， entry->extra_len， GFP_ATOMIC））） { ... } } while （（skb = __skb_dequeue（&entry->skb_list））） { skb_put_data（rx->skb， skb->data、skb->len）;dev_kfree_skb（skb）;} 在提交 69f132236827 （mac80211：壓縮結構 ieee80211_fragment_entry） 中，entry->extra_len 已從 unsigned int 縮小到 u16，以減少結構記憶體佔用。但是，一個 IEEE 802.11 框架序列最多可以包含 16 個片段（片段編號 0..15）。如果到達一系列大型片段（例如，來自惡意對等體或流氓 AP），則片段長度的總和可能超過 65535 位元組（例如，15 個 4400 位元組的片段總計 66000 位元組）。
    因為 extra_len 是 u16，所以這個加法會溢出並包裹在模 65536 周圍（例如 66000 換行到 464）。因此，pskb_expand_head（） 只會配置截斷的 tailroom 數量 （如果頭部片段已有 >= 464 位元組的 tailroom），則會完全跳過。當 skb_put_data（） 隨後迭代排入佇列的 skb 清單時，它會將完整的有效負載附加到尺寸過小的緩衝區中，導致 skb_put（） 觸發 skb_over_panic（） 並在 softirq 上下文中使核心崩潰。IEEE 802.11 中的合法 MSDU 最多為 2304 位元組（對於 A-MSDU 則高達 7935/11454 位元組，它不是分段的），遠低於 U16_MAX。透過檢查新增傳入片段長度是否會超過U16_MAX，在不增加結構ieee80211_fragment_entry大小的情況下修正此問題。如果是這樣，請清除佇列的片段並刪除框架。[指派單獨的刪除原因]（CVE-2026-98829）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - wifi：mac80211：删除超大片段以避免extra_len溢出 在 ieee80211_rx_h_defragment（） 中，片段负载会随着后续片段的到达而累积到 entry->extra_len：entry->extra_len += rx->skb->len;当最终片段到达时，头片段将被出列，并通过 entry->extra_len 调用 pskb_expand_head（），以确保在复制之前为所有排队的片段提供足够的尾空间： if （skb_tailroom（rx->skb） < entry->extra_len） { if （unlikely（pskb_expand_head（rx->skb， 0， entry->extra_len， GFP_ATOMIC））） { ... } } while （（skb = __skb_dequeue（&entry->skb_list））） { skb_put_data（rx->skb， skb->data、skb->len）;dev_kfree_skb（skb）;} 在提交 69f132236827（mac80211：缩小结构 ieee80211_fragment_entry）中，条目>extra_len从未签名的 int 缩小到 u16，以减少结构内存占用。但是，一个 IEEE 802.11 帧序列最多可包含 16 个片段（碎片编号 0..15）。如果到达一系列大型片段（例如来自恶意对等机或恶意 AP），则片段长度之和可超过 65535 个字节（例如，15 个 4400 字节的片段总计 66000 字节）。
    因为extra_len是 u16，所以此加法会溢出并封装模数 65536（例如 66000 封装为 464）。因此，pskb_expand_head（） 仅分配截断的 tailroom 量（如果头片段已有 >= 464 字节的 tailroom，则完全跳过）。当 skb_put_data（） 随后迭代已排入队列的 skb 列表时，会将完整负载附加到较小的缓冲区中，从而导致 skb_put（） 触发 skb_over_panic（） 并在 softirq 环境中造成内核崩溃。IEEE 802.11 中的合法 MSDU 最多为 2304 字节（A-MSDU 则高达 7935/11454 字节，不会被分段），远低于 U16_MAX。通过检查添加传入的片段长度是否会超过 U16_MAX，在不增加 struct ieee80211_fragment_entry 大小的情况下修复此问题。如果是这样，请清除排队的片段并丢弃帧。[分配单独的终止原因]（CVE-2026-98829）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - wifi:mac80211:extra_lenオーバーフローを回避するためにサイズが大きすぎるフラグメントをドロップします ieee80211_rx_h_defragment() では、後続のフラグメントが到着すると、フラグメントペイロードが entry->extra_len に蓄積されます: entry->extra_len += rx->skb->len;最後のフラグメントが到着したとき、ヘッドフラグメントは dequeue され、pskb_expand_head() が entry->extra_len 付きで呼び出されて、コピーする前にキューに入れられたすべてのフラグメントに十分なテールルームを確保します: if (skb_tailroom(rx->skb) < entry->extra_len) { if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len, GFP_ATOMIC))) { ... } } while ((skb = __skb_dequeue(&entry->skb_list))) { skb_put_data(rx->skb, skb->data、skb->len);dev_kfree_skb(skb);} コミット 69f132236827(mac80211:構造体の縮小ieee80211_fragment_entry)において、構造メモリのフットプリントを削減するために、entry->extra_len が符号なし整数から u16 に絞り込まれました。ただし、IEEE 802.11 フレームシーケンスには、最大 16 個のフラグメントを含めることができます(フラグ番号 0..15)。大きなフラグメントのシーケンスが(悪意のあるピアや不正なAPからなど)到着した場合、フラグメントの長さの合計は65535バイトを超える可能性があります(たとえば、4400バイトのフラグメント15個は合計66000バイトになります)。
    extra_len は u16 であるため、この加算はオーバーフローし、モジュロ 65536 をラップします(たとえば、66000 は 464 にラップされます)。その結果、pskb_expand_head() は切り捨てられた量の tailroom のみを割り当てます(もしくは、ヘッドフラグメントにすでに >= 464 バイトの tailroom がある場合は完全にスキップされます)。その後、skb_put_data()がキューに入れられたskbリストを反復するとき、フルペイロードをサイズの小さいバッファに追加するため、skb_put()がskb_over_panic()をトリガーし、softirqコンテキストでカーネルがクラッシュします。IEEE 802.11 での正当な MSDU は、最大 2304 バイト(フラグメント化されていない A-MSDU の場合は最大 7935/11454 バイト)であり、U16_MAX をはるかに下回っています。着信フラグメントの長さを追加するとU16_MAXを超えるかどうかをチェックすることで、struct ieee80211_fragment_entryのサイズを増やすことなくこれを修正します。その場合は、キューに入れられたフラグメントをパージし、フレームをドロップします。[ドロップの理由を別に割り当てます](CVE-2026-98829)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-9018-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - Network file systems library;

    - Stream parser;

    - ARM64 architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - User-Mode Linux (UML);

    - x86 architecture;

    - Block layer subsystem;

    - Android drivers;

    - Bluetooth drivers;

    - TPM device driver;

    - DPLL subsystem;

    - EDAC drivers;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - IIO subsystem;

    - IIO ADC drivers;

    - InfiniBand drivers;

    - Input Device (Miscellaneous) drivers;

    - Multiple devices driver;

    - MemoryStick subsystem;

    - MMC subsystem;

    - MTD block device drivers;

    - Network drivers;

    - Ethernet bonding driver;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - Ethernet team driver;

    - MediaTek network drivers;

    - NVME drivers;

    - Device tree and open firmware driver;

    - Power sequencing drivers;

    - Voltage and Current Regulator drivers;

    - Real Time Clock drivers;

    - SCSI subsystem;

    - Greybus lights staging drivers;

    - Trusted Execution Environment drivers;

    - Thunderbolt and USB4 drivers;

    - TTY drivers;

    - Cadence USB3 driver;

    - USB Device Class drivers;

    - USB core drivers;

    - DesignWare USB2 driver;

    - DesignWare USB3 driver;

    - USB Gadget drivers;

    - USB Serial drivers;

    - USB Mass Storage drivers;

    - USB Type-C support driver;

    - USB Type-C Port Controller Manager driver;

    - TI TPS6598x USB Power Delivery controller driver;

    - USB Type-C Connector System Software Interface driver;

    - Amazon Nitro Enclaves driver;

    - Virtual machine generation ID driver;

    - BTRFS file system;

    - File systems infrastructure;

    - SMB network file system;

    - XFS file system;

    - BPF subsystem;

    - io_uring subsystem;

    - Netfilter;

    - Namespaces infrastructure;

    - Networking core;

    - Networking subsytem;

    - Virtio network driver;

    - Bluetooth subsystem;

    - IPv4 networking;

    - Network traffic control;

    - Audit subsystem;

    - Control group (cgroup);

    - Perf events;

    - Kernel fork() syscall;

    - Kernel futex primitives;

    - KProbes tracing;

    - Kexec HandOver (KHO);

    - Kernel module support;

    - Tracing infrastructure;

    - Workqueue subsystem;

    - Memory management;

    - Ethernet bridge;

    - Devlink API;

    - IPv6 networking;

    - MAC80211 subsystem;

    - Management Component Transport Protocol (MCTP);

    - Open vSwitch;

    - Packet sockets;

    - SCTP protocol;

    - SMC sockets;

    - TIPC protocol;

    - VMware vSockets driver;

    - Wireless networking;

    - XFRM subsystem;

    - Drivers core;

    - Key management;

    - SELinux security module;

    - ALSA framework;

    - Creative Sound Blaster X-Fi driver;

    - Analog Devices audio codecs;

    - Maxim audio codecs;

    - Realtek audio codecs;

    - QCOM ASoC drivers;

    - Samsung ASoC drivers;

    - SoundWire (SDCA) ASoC drivers;

    - USB sound devices; (CVE-2026-68305, CVE-2026-72404, CVE-2026-72497, CVE-2026-74527, CVE-2026-74568,     CVE-2026-89568, CVE-2026-89764, CVE-2026-89907, CVE-2026-90144, CVE-2026-90155, CVE-2026-90162,     CVE-2026-90167, CVE-2026-90317, CVE-2026-93175, CVE-2026-98038, CVE-2026-98375, CVE-2026-98432,     CVE-2026-98655, CVE-2026-98656, CVE-2026-98657, CVE-2026-98658, CVE-2026-98659, CVE-2026-98660,     CVE-2026-98661, CVE-2026-98662, CVE-2026-98663, CVE-2026-98664, CVE-2026-98665, CVE-2026-98666,     CVE-2026-98667, CVE-2026-98668, CVE-2026-98669, CVE-2026-98670, CVE-2026-98671, CVE-2026-98672,     CVE-2026-98673, CVE-2026-98674, CVE-2026-98675, CVE-2026-98676, CVE-2026-98677, CVE-2026-98678,     CVE-2026-98679, CVE-2026-98680, CVE-2026-98681, CVE-2026-98682, CVE-2026-98683, CVE-2026-98684,     CVE-2026-98685, CVE-2026-98686, CVE-2026-98687, CVE-2026-98689, CVE-2026-98690, CVE-2026-98691,     CVE-2026-98692, CVE-2026-98693, CVE-2026-98694, CVE-2026-98695, CVE-2026-98696, CVE-2026-98697,     CVE-2026-98698, CVE-2026-98699, CVE-2026-98700, CVE-2026-98701, CVE-2026-98702, CVE-2026-98703,     CVE-2026-98704, CVE-2026-98705, CVE-2026-98706, CVE-2026-98707, CVE-2026-98708, CVE-2026-98709,     CVE-2026-98710, CVE-2026-98711, CVE-2026-98712, CVE-2026-98713, CVE-2026-98714, CVE-2026-98715,     CVE-2026-98716, CVE-2026-98717, CVE-2026-98718, CVE-2026-98719, CVE-2026-98720, CVE-2026-98721,     CVE-2026-98722, CVE-2026-98723, CVE-2026-98724, CVE-2026-98725, CVE-2026-98726, CVE-2026-98727,     CVE-2026-98728, CVE-2026-98729, CVE-2026-98730, CVE-2026-98731, CVE-2026-98732, CVE-2026-98733,     CVE-2026-98734, CVE-2026-98735, CVE-2026-98736, CVE-2026-98737, CVE-2026-98738, CVE-2026-98739,     CVE-2026-98740, CVE-2026-98741, CVE-2026-98742, CVE-2026-98743, CVE-2026-98744, CVE-2026-98745,     CVE-2026-98746, CVE-2026-98747, CVE-2026-98748, CVE-2026-98749, CVE-2026-98750, CVE-2026-98751,     CVE-2026-98752, CVE-2026-98753, CVE-2026-98754, CVE-2026-98755, CVE-2026-98756, CVE-2026-98757,     CVE-2026-98758, CVE-2026-98759, CVE-2026-98760, CVE-2026-98761, CVE-2026-98762, CVE-2026-98763,     CVE-2026-98764, CVE-2026-98765, CVE-2026-98766, CVE-2026-98767, CVE-2026-98768, CVE-2026-98769,     CVE-2026-98770, CVE-2026-98771, CVE-2026-98772, CVE-2026-98773, CVE-2026-98774, CVE-2026-98775,     CVE-2026-98776, CVE-2026-98777, CVE-2026-98778, CVE-2026-98779, CVE-2026-98780, CVE-2026-98781,     CVE-2026-98782, CVE-2026-98783, CVE-2026-98784, CVE-2026-98785, CVE-2026-98786, CVE-2026-98788,     CVE-2026-98789, CVE-2026-98790, CVE-2026-98791, CVE-2026-98792, CVE-2026-98793, CVE-2026-98794,     CVE-2026-98795, CVE-2026-98796, CVE-2026-98797, CVE-2026-98798, CVE-2026-98799, CVE-2026-98800,     CVE-2026-98801, CVE-2026-98802, CVE-2026-98803, CVE-2026-98804, CVE-2026-98805, CVE-2026-98806,     CVE-2026-98807, CVE-2026-98808, CVE-2026-98809, CVE-2026-98810, CVE-2026-98811, CVE-2026-98812,     CVE-2026-98813, CVE-2026-98814, CVE-2026-98816, CVE-2026-98817, CVE-2026-98818, CVE-2026-98819,     CVE-2026-98820, CVE-2026-98821, CVE-2026-98822, CVE-2026-98823, CVE-2026-98824, CVE-2026-98825,     CVE-2026-98826, CVE-2026-98827, CVE-2026-98828, CVE-2026-98829, CVE-2026-98830, CVE-2026-98831,     CVE-2026-98833, CVE-2026-98834, CVE-2026-98835, CVE-2026-98836, CVE-2026-98837, CVE-2026-98838,     CVE-2026-98839, CVE-2026-98840, CVE-2026-98841, CVE-2026-98842, CVE-2026-98843, CVE-2026-98844,     CVE-2026-98845, CVE-2026-98846, CVE-2026-98847, CVE-2026-98848, CVE-2026-98849, CVE-2026-98850,     CVE-2026-98851, CVE-2026-98852, CVE-2026-98853, CVE-2026-98854, CVE-2026-98855, CVE-2026-98856,     CVE-2026-98857, CVE-2026-98858, CVE-2026-98859, CVE-2026-98860, CVE-2026-98861, CVE-2026-98862,     CVE-2026-98863, CVE-2026-98931, CVE-2026-98932, CVE-2026-98933, CVE-2026-98934, CVE-2026-98935,     CVE-2026-98936, CVE-2026-98937, CVE-2026-98939, CVE-2026-98940, CVE-2026-98944, CVE-2026-98945,     CVE-2026-98946, CVE-2026-98947, CVE-2026-98948, CVE-2026-98949, CVE-2026-98950, CVE-2026-98951,     CVE-2026-98952, CVE-2026-98953, CVE-2026-98954, CVE-2026-98955, CVE-2026-98956, CVE-2026-98957,     CVE-2026-98958, CVE-2026-98959, CVE-2026-98960, CVE-2026-98961, CVE-2026-98962, CVE-2026-98963,     CVE-2026-98964, CVE-2026-98965, CVE-2026-98966, CVE-2026-98967, CVE-2026-98968, CVE-2026-98969,     CVE-2026-98970, CVE-2026-98971, CVE-2026-98972, CVE-2026-98973, CVE-2026-98974, CVE-2026-98975,     CVE-2026-98977, CVE-2026-98978, CVE-2026-98979, CVE-2026-98980, CVE-2026-98981, CVE-2026-98982,     CVE-2026-98983, CVE-2026-98984, CVE-2026-98985, CVE-2026-98986, CVE-2026-98987, CVE-2026-98988,     CVE-2026-98989, CVE-2026-98990, CVE-2026-98991, CVE-2026-98992, CVE-2026-98993, CVE-2026-98994,     CVE-2026-98995, CVE-2026-98996, CVE-2026-98997, CVE-2026-98999, CVE-2026-99000, CVE-2026-99001,     CVE-2026-99002, CVE-2026-99003, CVE-2026-99004, CVE-2026-99005, CVE-2026-99006, CVE-2026-99007,     CVE-2026-99008, CVE-2026-99009, CVE-2026-99010, CVE-2026-99011, CVE-2026-99012, CVE-2026-99013,     CVE-2026-99014, CVE-2026-99015, CVE-2026-99016, CVE-2026-99017, CVE-2026-99018, CVE-2026-99019,     CVE-2026-99020, CVE-2026-99021, CVE-2026-99022, CVE-2026-99023, CVE-2026-99024, CVE-2026-99025,     CVE-2026-99026, CVE-2026-99027, CVE-2026-99028, CVE-2026-99029, CVE-2026-99030, CVE-2026-99031,     CVE-2026-99032, CVE-2026-99033, CVE-2026-99034, CVE-2026-99035, CVE-2026-99036, CVE-2026-99037,     CVE-2026-99038, CVE-2026-99039, CVE-2026-99040, CVE-2026-99041, CVE-2026-99043, CVE-2026-99044,     CVE-2026-99045, CVE-2026-99046, CVE-2026-99047, CVE-2026-99048, CVE-2026-99049, CVE-2026-99050,     CVE-2026-99051, CVE-2026-99052, CVE-2026-99053, CVE-2026-99054, CVE-2026-99055, CVE-2026-99056,     CVE-2026-99057, CVE-2026-99058, CVE-2026-99059, CVE-2026-99060, CVE-2026-99061, CVE-2026-99062,     CVE-2026-99063, CVE-2026-99064, CVE-2026-99065, CVE-2026-99066, CVE-2026-99067, CVE-2026-99068,     CVE-2026-99069, CVE-2026-99070, CVE-2026-99071, CVE-2026-99072, CVE-2026-99073, CVE-2026-99074,     CVE-2026-99075, CVE-2026-99076, CVE-2026-99077, CVE-2026-99078, CVE-2026-99079, CVE-2026-99080,     CVE-2026-99081, CVE-2026-99088, CVE-2026-99089, CVE-2026-99090, CVE-2026-99091, CVE-2026-99092,     CVE-2026-99093, CVE-2026-99094, CVE-2026-99095, CVE-2026-99096, CVE-2026-99097, CVE-2026-99098,     CVE-2026-99099, CVE-2026-99999)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - wifi: mac80211: drop oversized fragments to avoid extra_len overflow In ieee80211_rx_h_defragment(),     fragment payloads are accumulated into entry->extra_len as subsequent fragments arrive: entry->extra_len     += rx->skb->len; When the final fragment arrives, the head fragment is dequeued, and pskb_expand_head() is     called with entry->extra_len to ensure sufficient tailroom for all queued fragments before copying: if     (skb_tailroom(rx->skb) < entry->extra_len) { if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,     GFP_ATOMIC))) { ... } } while ((skb = __skb_dequeue(&entry->skb_list))) { skb_put_data(rx->skb, skb->data,     skb->len); dev_kfree_skb(skb); } In commit 69f132236827 (mac80211: shrink struct     ieee80211_fragment_entry), entry->extra_len was narrowed from unsigned int to u16 in order to reduce     structure memory footprint. However, an IEEE 802.11 frame sequence can contain up to 16 fragments (frag     numbers 0..15). If a sequence of large fragments arrives (e.g. from a malicious peer or rogue AP), the sum     of fragment lengths can exceed 65535 bytes (for example, 15 fragments of 4400 bytes total 66000 bytes).
    Because extra_len is a u16, this addition overflows and wraps around modulo 65536 (e.g. 66000 wraps to     464). Consequently, pskb_expand_head() allocates only the truncated amount of tailroom (or is skipped     entirely if the head fragment already has >= 464 bytes of tailroom). When skb_put_data() subsequently     iterates through the queued skb list, it appends the full payload into the undersized buffer, causing     skb_put() to trigger skb_over_panic() and crash the kernel in softirq context. A legitimate MSDU in IEEE     802.11 is at most 2304 bytes (or up to 7935/11454 bytes for A-MSDU, which is not fragmented), well below     U16_MAX. Fix this without increasing the size of struct ieee80211_fragment_entry by checking whether     adding the incoming fragment length would exceed U16_MAX. If so, purge the queued fragments and drop the     frame. [assign a separate drop reason] (CVE-2026-98829)

Note that Nessus relies on the presence of the package as reported by the vendor.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793786843 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: soc: qcom: qmi_encdec: Restrict string     length in decode The QMI TLV value for strings in a lot of qmi element info structures account for null     terminated strings with MAX_LEN + 1. If a string is actually MAX_LEN + 1 length, this will cause an out of     bounds access when the NULL character is appended in decoding. (CVE-2023-53729)

  - In the Linux kernel, the following vulnerability has been resolved: rv: Use strings in da monitors     tracepoints Using DA monitors tracepoints with KASAN enabled triggers the following warning: BUG: KASAN:
    global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 Read of size 32 at addr     ffffffffaada8980 by task ... Call Trace: <TASK> [...] do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0     ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10 ? trace_event_sncid+0x83/0x200     trace_event_sncid+0x163/0x200 [...] The buggy address belongs to the variable: automaton_snep+0x4e0/0x5e0     This is caused by the tracepoints reading 32 bytes __array instead of __string from the automata     definition. Such strings are literals and reading 32 bytes ends up in out of bound memory accesses (e.g.
    the next automaton's data in this case). The error is harmless as, while printing the string, we stop at     the null terminator, but it should still be fixed. Use the __string facilities while defining the     tracepoints to avoid reading out of bound memory. (CVE-2025-38636)

  - In the Linux kernel, the following vulnerability has been resolved: perf: arm_spe: Prevent overflow in     PERF_IDX2OFF() Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2     GiB). (CVE-2025-40081)

  - In the Linux kernel, the following vulnerability has been resolved: arch_topology: Fix incorrect error     check in topology_parse_cpu_capacity() Fix incorrect use of PTR_ERR_OR_ZERO() in     topology_parse_cpu_capacity() which causes the code to proceed with NULL clock pointers. The current logic     uses !PTR_ERR_OR_ZERO(cpu_clk) which evaluates to true for both valid pointers and NULL, leading to     potential NULL pointer dereference in clk_get_rate(). Per include/linux/err.h documentation,     PTR_ERR_OR_ZERO(ptr) returns: The error code within @ptr if it is an error pointer; 0 otherwise. This     means PTR_ERR_OR_ZERO() returns 0 for both valid pointers AND NULL pointers. Therefore     !PTR_ERR_OR_ZERO(cpu_clk) evaluates to true (proceed) when cpu_clk is either valid or NULL, causing     clk_get_rate(NULL) to be called when of_clk_get() returns NULL. Replace with !IS_ERR_OR_NULL(cpu_clk)     which only proceeds for valid pointers, preventing potential NULL pointer dereference in clk_get_rate().
    (CVE-2025-40346)

  - In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Add support for     Van Gogh SoC The ROG Xbox Ally (non-X) SoC features a similar architecture to the Steam Deck. While the     Steam Deck supports S3 (s2idle causes a crash), this support was dropped by the Xbox Ally which only S0ix     suspend. Since the handler is missing here, this causes the device to not suspend and the AMD GPU driver     to crash while trying to resume afterwards due to a power hang. (CVE-2025-68334)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
367102	Linux Distros 未修補弱點：CVE-2026-98829	Nessus	Misc.	2026/10/18	2026/11/13	medium
367102	Linux Distros 未修补的漏洞：CVE-2026-98829	Nessus	Misc.	2026/10/18	2026/11/13	medium
367102	Linux Distros のパッチ未適用の脆弱性: CVE-2026-98829	Nessus	Misc.	2026/10/18	2026/11/13	medium
381339	Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-9018-1)	Nessus	Ubuntu Local Security Checks	2026/11/14	2026/11/14	critical
367102	Linux Distros Unpatched Vulnerability : CVE-2026-98829	Nessus	Misc.	2026/10/18	2026/11/13	medium
376201	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793786843)	Nessus	Alma Linux Local Security Checks	2026/11/5	2026/11/13	high

偵測

搜尋 Plugin

medium

medium

medium

critical

medium

high