Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - vt： selection：修正 paste_selection（） 中無符號的反向溢位和 slab-out-of-bounds 讀取 在 paste_selection（） 中，迴圈每次迭代會將 min_t（unsigned int， vc_sel.buf_len - pasted，tty->receive_room） 位元組複製到 tty_ldisc_receive_buf（） 中，並增加貼上 += 計數。因為選取互斥 （vc_sel.lock） 被丟棄在迴圈內 每當行紀律緩衝區填滿並且 paste_selection（） 休眠在 tty->write_wait 上時，並行 TIOCLINUX （TIOCL_SETSEL） ioctl 可以用較短的選擇替換 vc_sel.buffer，並將 vc_sel.buf_len 減少到以下貼上。當 paste_selection（） 恢復時，vc_sel.buf_len - 將反向溢位貼到一個大的正值，以不帶正負號的整數形式貼上，導致 tty_ldisc_receive_buf（ld， vc_sel.buffer + pasted， NULL， count） 讀取最多 4094 個位元組的越界，超過新配置的 vc_sel.buffer。透過在貼上 >= vc_sel.buf_len 時終止迴圈來修正此問題。核心堆疊追蹤 （Linux 7.3.0-rc3）： ================================================================== 錯誤：
    KASAN：在 n_tty_receive_buf_common+0xa01/0x1650 中的 slab-out-of-bounds 透過任務 kworker/u17：1/65 在 addr ffff888101c58010 讀取大小為 4094 工作佇列：events_unbound flush_to_ldisc 呼叫追蹤： <TASK> dump_stack_lvl+0x70/0xa0 print_report+0x153/0x4c6 kasan_report+0xf1/0x120 kasan_check_range+0x11c/0x200
    __asan_memcpy+0x29/0x70 n_tty_receive_buf_common+0xa01/0x1650 tty_ldisc_receive_buf+0x66/0x110 tty_port_default_receive_buf+0x6b/0xb0 flush_to_ldisc+0x1b4/0x410 process_one_work+0x6ff/0x1110 worker_thread+0x4a8/0xb70 kthread+0x307/0x3e0 ret_from_fork+0x3ed/0x680 </TASK> ================================================================== （CVE-2026-98839）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - vt：selection：修复 paste_selection（） 中的未签名下溢和 slab-out-of-bound 读取 在 paste_selection（） 中，循环每次迭代将 min_t（unsigned int， vc_sel.buf_len - pasted，tty->receive_room） 字节复制到 tty_ldisc_receive_buf（） 中，并递增粘贴的 += 计数。由于选择互斥体 （vc_sel.lock） 在循环中丢弃，因此每当行规则缓冲区填满且 paste_selection（） 在 tty->write_wait 上休眠时，并行 TIOCLINUX （TIOCL_SETSEL） ioctl 可将 vc_sel.buffer 替换为较短的选择，并减少粘贴的 vc_sel.buf_len。当 paste_selection（） 恢复时，vc_sel.buf_len 粘贴的下溢为大正值的无符号整数，从而导致 tty_ldisc_receive_buf（ld， vc_sel.buffer + pasted， NULL， count） 越界读取多达 4094 字节，超出新分配的 vc_sel.buffer。通过在粘贴到 >= vc_sel.buf_len 时终止循环来修复此问题。内核堆栈跟踪 （Linux 7.3.0-rc3）： ================================================================== 缺陷：
    KASAN：任务 kworker/u17：1/65 在地址 ffff888101c58010 处读取大小为 4094 的 n_tty_receive_buf_common+0xa01/0x1650 中的 slab-out-ofbound 工作队列：events_unbound flush_to_ldisc 调用跟踪： <TASK> dump_stack_lvl+0x70/0xa0 print_report+0x153/0x4c6 kasan_report+0xf1/0x120 kasan_check_range+0x11c/0x200
    __asan_memcpy+0x29/0x70 n_tty_receive_buf_common+0xa01/0x1650 tty_ldisc_receive_buf+0x66/0x110 tty_port_default_receive_buf+0x6b/0xb0 flush_to_ldisc+0x1b4/0x410 process_one_work+0x6ff/0x1110 worker_thread+0x4a8/0xb70 kthread+0x307/0x3e0 ret_from_fork+0x3ed/0x680 </TASK> ================================================================== （CVE-2026-98839）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - vt:選択:paste_selection() の符号なしアンダーフローおよびスラブの領域外読み取りを修正します paste_selection() では、ループが反復ごとに min_t(unsigned int, vc_sel.buf_len - pasted,tty->receive_room) バイトを tty_ldisc_receive_buf() にコピーし、+= カウントに貼り付けます。選択 mutex (vc_sel.lock) がループ内でドロップされるため 行の規則バッファがいっぱいになり、 paste_selection() が tty->write_wait でスリープ状態になるたびに、同時 TIOCLINUX (TIOCL_SETSEL) ioctl が vc_sel.buffer をより短い選択に置き換え、貼り付けられた vc_sel.buf_len を以下に減らすことができます。paste_selection() が再開すると、vc_sel.buf_len - アンダーフローを大きな正の値に符号なし整数として貼り付けます。これにより、tty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) が新しく割り当てられた vc_sel.buffer を過ぎて、領域外から最大 4094 バイトまで読み取ります。>= vc_sel.buf_len を貼り付けるときにループを終了することで、これを修正します。カーネルスタックトレース(Linux 7.3.0-rc3): ==================================================================バグ:
    KASAN:0x1650 0xa01 n_tty_receive_buf_commonタスク kworker/u17:1/65 による addr ffff888101c58010 でのサイズ 4094 のサイズ 4094 の kworker/u17:1/65 ワークロードキューによる slab-out-of-bounds ワークロードキュー:events_unbound flush_to_ldisc コールトレース: <TASK> dump_stack_lvl+0x70/0xa0 print_report+0x153/0x4c6 kasan_report+0xf1/0x120 kasan_check_range+0x11c/0x200
    __asan_memcpy+0x29/0x70 n_tty_receive_buf_common+0xa01/0x1650 tty_ldisc_receive_buf+0x66/0x110 tty_port_default_receive_buf+0x6b/0xb0 flush_to_ldisc+0x1b4/0x410 process_one_work+0x6ff/0x1110 worker_thread+0x4a8/0xb70 kthread+0x307/0x3e0 ret_from_fork+0x3ed/0x680 </TASK> ==================================================================(CVE-2026-98839)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() In     paste_selection(), the loop copies min_t(unsigned int, vc_sel.buf_len - pasted,tty->receive_room) bytes     per iteration into tty_ldisc_receive_buf() and increments pasted += count. Because the selection mutex     (vc_sel.lock) is dropped inside the loop Whenever the line discipline buffer fills up and     paste_selection() sleeps on tty->write_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl can replace     vc_sel.buffer with a shorter selection and reduce vc_sel.buf_len below pasted. When paste_selection()     resumes, vc_sel.buf_len - pasted underflows as an unsigned integer to a large positive value, causing     tty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) to read up to 4094 bytes out-of-bounds past     the newly allocated vc_sel.buffer. Fix this by terminating the loop when pasted >= vc_sel.buf_len. Kernel     stack trace (Linux 7.3.0-rc3): ================================================================== BUG:
    KASAN: slab-out-of-bounds in n_tty_receive_buf_common+0xa01/0x1650 Read of size 4094 at addr     ffff888101c58010 by task kworker/u17:1/65 Workqueue: events_unbound flush_to_ldisc Call Trace: <TASK>     dump_stack_lvl+0x70/0xa0 print_report+0x153/0x4c6 kasan_report+0xf1/0x120 kasan_check_range+0x11c/0x200
    __asan_memcpy+0x29/0x70 n_tty_receive_buf_common+0xa01/0x1650 tty_ldisc_receive_buf+0x66/0x110     tty_port_default_receive_buf+0x6b/0xb0 flush_to_ldisc+0x1b4/0x410 process_one_work+0x6ff/0x1110     worker_thread+0x4a8/0xb70 kthread+0x307/0x3e0 ret_from_fork+0x3ed/0x680 </TASK>     ================================================================== (CVE-2026-98839)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-9018-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - Network file systems library;

    - Stream parser;

    - ARM64 architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - User-Mode Linux (UML);

    - x86 architecture;

    - Block layer subsystem;

    - Android drivers;

    - Bluetooth drivers;

    - TPM device driver;

    - DPLL subsystem;

    - EDAC drivers;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - IIO subsystem;

    - IIO ADC drivers;

    - InfiniBand drivers;

    - Input Device (Miscellaneous) drivers;

    - Multiple devices driver;

    - MemoryStick subsystem;

    - MMC subsystem;

    - MTD block device drivers;

    - Network drivers;

    - Ethernet bonding driver;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - Ethernet team driver;

    - MediaTek network drivers;

    - NVME drivers;

    - Device tree and open firmware driver;

    - Power sequencing drivers;

    - Voltage and Current Regulator drivers;

    - Real Time Clock drivers;

    - SCSI subsystem;

    - Greybus lights staging drivers;

    - Trusted Execution Environment drivers;

    - Thunderbolt and USB4 drivers;

    - TTY drivers;

    - Cadence USB3 driver;

    - USB Device Class drivers;

    - USB core drivers;

    - DesignWare USB2 driver;

    - DesignWare USB3 driver;

    - USB Gadget drivers;

    - USB Serial drivers;

    - USB Mass Storage drivers;

    - USB Type-C support driver;

    - USB Type-C Port Controller Manager driver;

    - TI TPS6598x USB Power Delivery controller driver;

    - USB Type-C Connector System Software Interface driver;

    - Amazon Nitro Enclaves driver;

    - Virtual machine generation ID driver;

    - BTRFS file system;

    - File systems infrastructure;

    - SMB network file system;

    - XFS file system;

    - BPF subsystem;

    - io_uring subsystem;

    - Netfilter;

    - Namespaces infrastructure;

    - Networking core;

    - Networking subsytem;

    - Virtio network driver;

    - Bluetooth subsystem;

    - IPv4 networking;

    - Network traffic control;

    - Audit subsystem;

    - Control group (cgroup);

    - Perf events;

    - Kernel fork() syscall;

    - Kernel futex primitives;

    - KProbes tracing;

    - Kexec HandOver (KHO);

    - Kernel module support;

    - Tracing infrastructure;

    - Workqueue subsystem;

    - Memory management;

    - Ethernet bridge;

    - Devlink API;

    - IPv6 networking;

    - MAC80211 subsystem;

    - Management Component Transport Protocol (MCTP);

    - Open vSwitch;

    - Packet sockets;

    - SCTP protocol;

    - SMC sockets;

    - TIPC protocol;

    - VMware vSockets driver;

    - Wireless networking;

    - XFRM subsystem;

    - Drivers core;

    - Key management;

    - SELinux security module;

    - ALSA framework;

    - Creative Sound Blaster X-Fi driver;

    - Analog Devices audio codecs;

    - Maxim audio codecs;

    - Realtek audio codecs;

    - QCOM ASoC drivers;

    - Samsung ASoC drivers;

    - SoundWire (SDCA) ASoC drivers;

    - USB sound devices; (CVE-2026-68305, CVE-2026-72404, CVE-2026-72497, CVE-2026-74527, CVE-2026-74568,     CVE-2026-89568, CVE-2026-89764, CVE-2026-89907, CVE-2026-90144, CVE-2026-90155, CVE-2026-90162,     CVE-2026-90167, CVE-2026-90317, CVE-2026-93175, CVE-2026-98038, CVE-2026-98375, CVE-2026-98432,     CVE-2026-98655, CVE-2026-98656, CVE-2026-98657, CVE-2026-98658, CVE-2026-98659, CVE-2026-98660,     CVE-2026-98661, CVE-2026-98662, CVE-2026-98663, CVE-2026-98664, CVE-2026-98665, CVE-2026-98666,     CVE-2026-98667, CVE-2026-98668, CVE-2026-98669, CVE-2026-98670, CVE-2026-98671, CVE-2026-98672,     CVE-2026-98673, CVE-2026-98674, CVE-2026-98675, CVE-2026-98676, CVE-2026-98677, CVE-2026-98678,     CVE-2026-98679, CVE-2026-98680, CVE-2026-98681, CVE-2026-98682, CVE-2026-98683, CVE-2026-98684,     CVE-2026-98685, CVE-2026-98686, CVE-2026-98687, CVE-2026-98689, CVE-2026-98690, CVE-2026-98691,     CVE-2026-98692, CVE-2026-98693, CVE-2026-98694, CVE-2026-98695, CVE-2026-98696, CVE-2026-98697,     CVE-2026-98698, CVE-2026-98699, CVE-2026-98700, CVE-2026-98701, CVE-2026-98702, CVE-2026-98703,     CVE-2026-98704, CVE-2026-98705, CVE-2026-98706, CVE-2026-98707, CVE-2026-98708, CVE-2026-98709,     CVE-2026-98710, CVE-2026-98711, CVE-2026-98712, CVE-2026-98713, CVE-2026-98714, CVE-2026-98715,     CVE-2026-98716, CVE-2026-98717, CVE-2026-98718, CVE-2026-98719, CVE-2026-98720, CVE-2026-98721,     CVE-2026-98722, CVE-2026-98723, CVE-2026-98724, CVE-2026-98725, CVE-2026-98726, CVE-2026-98727,     CVE-2026-98728, CVE-2026-98729, CVE-2026-98730, CVE-2026-98731, CVE-2026-98732, CVE-2026-98733,     CVE-2026-98734, CVE-2026-98735, CVE-2026-98736, CVE-2026-98737, CVE-2026-98738, CVE-2026-98739,     CVE-2026-98740, CVE-2026-98741, CVE-2026-98742, CVE-2026-98743, CVE-2026-98744, CVE-2026-98745,     CVE-2026-98746, CVE-2026-98747, CVE-2026-98748, CVE-2026-98749, CVE-2026-98750, CVE-2026-98751,     CVE-2026-98752, CVE-2026-98753, CVE-2026-98754, CVE-2026-98755, CVE-2026-98756, CVE-2026-98757,     CVE-2026-98758, CVE-2026-98759, CVE-2026-98760, CVE-2026-98761, CVE-2026-98762, CVE-2026-98763,     CVE-2026-98764, CVE-2026-98765, CVE-2026-98766, CVE-2026-98767, CVE-2026-98768, CVE-2026-98769,     CVE-2026-98770, CVE-2026-98771, CVE-2026-98772, CVE-2026-98773, CVE-2026-98774, CVE-2026-98775,     CVE-2026-98776, CVE-2026-98777, CVE-2026-98778, CVE-2026-98779, CVE-2026-98780, CVE-2026-98781,     CVE-2026-98782, CVE-2026-98783, CVE-2026-98784, CVE-2026-98785, CVE-2026-98786, CVE-2026-98788,     CVE-2026-98789, CVE-2026-98790, CVE-2026-98791, CVE-2026-98792, CVE-2026-98793, CVE-2026-98794,     CVE-2026-98795, CVE-2026-98796, CVE-2026-98797, CVE-2026-98798, CVE-2026-98799, CVE-2026-98800,     CVE-2026-98801, CVE-2026-98802, CVE-2026-98803, CVE-2026-98804, CVE-2026-98805, CVE-2026-98806,     CVE-2026-98807, CVE-2026-98808, CVE-2026-98809, CVE-2026-98810, CVE-2026-98811, CVE-2026-98812,     CVE-2026-98813, CVE-2026-98814, CVE-2026-98816, CVE-2026-98817, CVE-2026-98818, CVE-2026-98819,     CVE-2026-98820, CVE-2026-98821, CVE-2026-98822, CVE-2026-98823, CVE-2026-98824, CVE-2026-98825,     CVE-2026-98826, CVE-2026-98827, CVE-2026-98828, CVE-2026-98829, CVE-2026-98830, CVE-2026-98831,     CVE-2026-98833, CVE-2026-98834, CVE-2026-98835, CVE-2026-98836, CVE-2026-98837, CVE-2026-98838,     CVE-2026-98839, CVE-2026-98840, CVE-2026-98841, CVE-2026-98842, CVE-2026-98843, CVE-2026-98844,     CVE-2026-98845, CVE-2026-98846, CVE-2026-98847, CVE-2026-98848, CVE-2026-98849, CVE-2026-98850,     CVE-2026-98851, CVE-2026-98852, CVE-2026-98853, CVE-2026-98854, CVE-2026-98855, CVE-2026-98856,     CVE-2026-98857, CVE-2026-98858, CVE-2026-98859, CVE-2026-98860, CVE-2026-98861, CVE-2026-98862,     CVE-2026-98863, CVE-2026-98931, CVE-2026-98932, CVE-2026-98933, CVE-2026-98934, CVE-2026-98935,     CVE-2026-98936, CVE-2026-98937, CVE-2026-98939, CVE-2026-98940, CVE-2026-98944, CVE-2026-98945,     CVE-2026-98946, CVE-2026-98947, CVE-2026-98948, CVE-2026-98949, CVE-2026-98950, CVE-2026-98951,     CVE-2026-98952, CVE-2026-98953, CVE-2026-98954, CVE-2026-98955, CVE-2026-98956, CVE-2026-98957,     CVE-2026-98958, CVE-2026-98959, CVE-2026-98960, CVE-2026-98961, CVE-2026-98962, CVE-2026-98963,     CVE-2026-98964, CVE-2026-98965, CVE-2026-98966, CVE-2026-98967, CVE-2026-98968, CVE-2026-98969,     CVE-2026-98970, CVE-2026-98971, CVE-2026-98972, CVE-2026-98973, CVE-2026-98974, CVE-2026-98975,     CVE-2026-98977, CVE-2026-98978, CVE-2026-98979, CVE-2026-98980, CVE-2026-98981, CVE-2026-98982,     CVE-2026-98983, CVE-2026-98984, CVE-2026-98985, CVE-2026-98986, CVE-2026-98987, CVE-2026-98988,     CVE-2026-98989, CVE-2026-98990, CVE-2026-98991, CVE-2026-98992, CVE-2026-98993, CVE-2026-98994,     CVE-2026-98995, CVE-2026-98996, CVE-2026-98997, CVE-2026-98999, CVE-2026-99000, CVE-2026-99001,     CVE-2026-99002, CVE-2026-99003, CVE-2026-99004, CVE-2026-99005, CVE-2026-99006, CVE-2026-99007,     CVE-2026-99008, CVE-2026-99009, CVE-2026-99010, CVE-2026-99011, CVE-2026-99012, CVE-2026-99013,     CVE-2026-99014, CVE-2026-99015, CVE-2026-99016, CVE-2026-99017, CVE-2026-99018, CVE-2026-99019,     CVE-2026-99020, CVE-2026-99021, CVE-2026-99022, CVE-2026-99023, CVE-2026-99024, CVE-2026-99025,     CVE-2026-99026, CVE-2026-99027, CVE-2026-99028, CVE-2026-99029, CVE-2026-99030, CVE-2026-99031,     CVE-2026-99032, CVE-2026-99033, CVE-2026-99034, CVE-2026-99035, CVE-2026-99036, CVE-2026-99037,     CVE-2026-99038, CVE-2026-99039, CVE-2026-99040, CVE-2026-99041, CVE-2026-99043, CVE-2026-99044,     CVE-2026-99045, CVE-2026-99046, CVE-2026-99047, CVE-2026-99048, CVE-2026-99049, CVE-2026-99050,     CVE-2026-99051, CVE-2026-99052, CVE-2026-99053, CVE-2026-99054, CVE-2026-99055, CVE-2026-99056,     CVE-2026-99057, CVE-2026-99058, CVE-2026-99059, CVE-2026-99060, CVE-2026-99061, CVE-2026-99062,     CVE-2026-99063, CVE-2026-99064, CVE-2026-99065, CVE-2026-99066, CVE-2026-99067, CVE-2026-99068,     CVE-2026-99069, CVE-2026-99070, CVE-2026-99071, CVE-2026-99072, CVE-2026-99073, CVE-2026-99074,     CVE-2026-99075, CVE-2026-99076, CVE-2026-99077, CVE-2026-99078, CVE-2026-99079, CVE-2026-99080,     CVE-2026-99081, CVE-2026-99088, CVE-2026-99089, CVE-2026-99090, CVE-2026-99091, CVE-2026-99092,     CVE-2026-99093, CVE-2026-99094, CVE-2026-99095, CVE-2026-99096, CVE-2026-99097, CVE-2026-99098,     CVE-2026-99099, CVE-2026-99999)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
371850	Amazon Linux 2023：bpftool6.18、kernel6.18、kernel6.18-devel (ALAS2023-2026-3251)	Nessus	Amazon Linux Local Security Checks	2026/10/25	2026/11/2	critical
371850	Amazon Linux 2023：bpftool6.18、kernel6.18、kernel6.18-devel (ALAS2023-2026-3251)	Nessus	Amazon Linux Local Security Checks	2026/10/25	2026/11/2	critical
367060	Linux Distros 未修補弱點：CVE-2026-98839	Nessus	Misc.	2026/10/18	2026/11/11	high
367060	Linux Distros 未修补的漏洞：CVE-2026-98839	Nessus	Misc.	2026/10/18	2026/11/11	high
371850	Amazon Linux 2023 : bpftool6.18、kernel6.18、kernel6.18-devel (ALAS2023-2026-3251)	Nessus	Amazon Linux Local Security Checks	2026/10/25	2026/11/2	critical
367060	Linux Distros のパッチ未適用の脆弱性: CVE-2026-98839	Nessus	Misc.	2026/10/18	2026/11/11	high
367060	Linux Distros Unpatched Vulnerability : CVE-2026-98839	Nessus	Misc.	2026/10/18	2026/11/11	high
371850	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3251)	Nessus	Amazon Linux Local Security Checks	2026/10/25	2026/11/2	critical
381339	Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-9018-1)	Nessus	Ubuntu Local Security Checks	2026/11/14	2026/11/14	critical

偵測

搜尋 Plugin

critical

critical

high

high

critical

high

high

critical

critical