Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - xfs：修正 exchange-range-to-eof 檔案大小交換 Norbert Szetei 發布了一個修補程式，其中包含對 XFS_IOC_EXCHANGE_RANGE TO_EOF 標誌中錯誤的不完整描述。此錯誤會誘騙 exchange-range 修改檔案，使其具有從 EOF 開始的共用區塊，這是絕對不允許的，因為檔案從未寫入超過 EOF 的資料，而且您只能共用寫入的資料區塊。這是隨後所有不正確行為的關鍵。最終，我從諾伯特那裡得到了關於出了什麼問題的描述：>公平。這是物理區塊編號，4k 區塊。peer 是重寫的檔案>，而 file1 是最終清除旗標>檔案。> > 開始，沒有共用任何內容：> >對等體大小 4096 -> [100] > file1 大小 12288 -> [200] [201] [202] > donor1 大小 4096 -> [300] > donor2 大小 4096 -> [400] > > 1.FICLONERANGE 對等體的區塊進入 file1 的中間插槽： > > 對等體大小 4096 -> [100] > file1 大小 12288 -> [200] [100] [202] reflink 旗標設定 > ^^^^^ 兩個檔案都擁有區塊 100 > > 2。XFS_IOC_EXCHANGE_RANGE文件 1 針對捐贈者 1，file1_offset 0，> file2_offset 8192，長度 0，TO_EOF。一個區塊被交換，>的大小與之交換：> > file1 大小 4096 -> [200] [100] [300] reflink 旗標集 > ^^^^^^^^^^^ 仍然擁有，現在已經超過了 donor1 大小>大小 12288 -> [202] > > file1 說它有一個區塊長，但它仍然擁有三個區塊。沒有什麼是>未繪製的。file2_offset是區塊 2，因此此交換無法清除旗標。> > 3.
    XFS_IOC_EXCHANGE_RANGE文件 1 針對捐贈者 2，兩個偏移量 0，長度 4096。> i_disk_size這是兩個單區塊檔案交換所有內容，因此 > xmi_can_exchange_reflink_flags（） 同意並清除標誌： > > file1 大小 4096 -> [400] [100] [300] reflink 標誌 > donor2 大小 4096 -> [200] 清除 > > 區塊 100 仍與對等體共用。> > 4.pwrite（file1， 4096， 4096），這是 file1 的第二個插槽，區塊 100。> xfs_is_cow_inode（file1） 為 false，因此沒有 CoW：> >對等體大小 4096 -> [100] 相同的區塊，區塊 100 > >新內容是這裡唯一重要的。PoC，它會讀取目前目錄中>稱為peer的檔案。檔案系統需要 reflink 和 > exchange-range，mkfs.xfs 7.x 預設會開啟。所以，是的，TO_EOF正在搞砸文件大小，即使它實際上正確地交換了數據塊。以下是 XFS_EXCHANGE_RANGE_TO_EOF 的預期行為，如其手冊頁所述： 忽略長度參數。從 file1_offset 到 EOF 的file1_fd中的所有位元組都會移至 file2_fd，而 file2 的大小會設定為 （file2_offset+（file1_length-file1_offset））。同時，file2 中從 file2_offset 到 EOF 的所有位元組都會移至 file1，並且 file1 的大小設定為 （file1_offset+（file2_length-file2_offset））。換句話說，如果我們只交換一部分文件數據，那麼我們應該只交換與交換數據相關的文件大小部分。不幸的是，程式碼會交換磁碟上的檔案大小和核心檔案大小，如果呼叫端傳入非零位移，則這是不正確的。混淆了檔案大小後，PoC 對看起來像未參照連結的單一區塊檔案使用第二個交換範圍呼叫。
    由於檔案大小設定不正確，exchange-range 會認為它正在交換兩個檔案的完整內容，並清除損毀檔案上的 reflink 旗標。這可讓您擴充損毀檔案的寫入，以重寫剛過 EOF 的共用區塊。這已被通俗地稱為反流。正確設定檔案大小之後，第二個交換範圍就不會再認為它正在執行完整內容交換，因此它不會清除其任一檔案引數上的 reflink 旗標。Norbert 在此修補程式的早期版本之後，對我們沒有正確處理i_disk_size狀態提出了第二個抱怨：> 偏移量與內核i_size為界，但從>中減去 ---truncated--- （CVE-2026-98974）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - xfs：修复 exchange-range-to-eof 文件大小交换 Norbert Szetei 发布了一个修补程序，其中包含对 XFS_IOC_EXCHANGE_RANGE TO_EOF标记中一个缺陷的不完整描述。该错误诱骗 exchange-range 修改文件，使其共享从 EOF 之外开始的区块，这是绝对不允许的，因为文件从未写入超过 EOF 的数据，并且您只能共享写入的数据区块。这是随后所有不正确行为的关键。最终，我从诺伯特那里得到了对问题所在的描述：>公平。这里是带有物理块号，4k 块。peer 是要重写的文件>，file1 是最后清除标记>的文件。> > 启动，未共享任何内容：> > 对等机大小 4096 -> [100] > file1 大小 12288 -> [200] [201] [202] > donor1 大小 4096 -> [300] > donor2 大小 4096 -> [400] > > 1.FICLONERANGE 对等机的区块进入 file1 的中间插槽：> > 对等机大小 4096 -> [100] > file1 大小 12288 -> [200] [100] [202] reflink 标记集 > ^^^^^ 两个文件都拥有区块 100 > > 2。XFS_IOC_EXCHANGE_RANGE file1 与 donor1，file1_offset 0，> file2_offset 8192，长度 0，TO_EOF。交换一个区块，>大小与其交换：> > file1 大小 4096 -> [200] [100] [300] reflink 标志集 > ^^^^^^^^^^^ 仍然拥有，现在已超过 donor1 大小>大小 12288 -> [202] > > file1 表示它是一个区块长，但它仍然拥有三个。没有任何>未映射的内容。file2_offset为区块 2，因此此交换无法清除标记。> > 3.
    XFS_IOC_EXCHANGE_RANGE file1 与 donor2，均偏移 0，长度 4096。> 通过i_disk_size这是两个交换所有内容的单块文件，因此 > xmi_can_exchange_reflink_flags（） 同意并清除该标记：> > file1 大小 4096 -> [400] [100] [300] reflink 标记已清除 > donor2 大小 4096 -> [200] > > 区块 100 仍与对等项共享。> > 4.pwrite（file1， 4096， 4096），这是 file1 的第二个插槽，区块 100。> xfs_is_cow_inode（file1） 为 false，因此没有 CoW：> > 对等机大小为 4096 -> [100] 相同的区块，区块 100 > >新内容在这里唯一重要。PoC 下方，它会读取当前目录中>称为 peer 的文件。文件系统需要 reflink 和 > exchange-range，mkfs.xfs 7.x 默认会将其打开。所以，是的，TO_EOF正在搞砸文件大小，即使它实际上正在正确交换数据块。以下是 XFS_EXCHANGE_RANGE_TO_EOF 的预期行为，如其手册页所述： 忽略长度参数。file1_fd中从 file1_offset 到 EOF 的所有字节都移到了 file2_fd，file2 的大小也设为 （file2_offset+（file1_length-file1_offset））。同时，file2 中从 file2_offset 到 EOF 的所有字节移动到 file1，file1 的大小设置为 （file1_offset+（file2_length-file2_offset））。换句话说，如果我们只交换一部分文件数据，那么我们应该只交换与交换数据相关的部分文件大小。遗憾的是，代码会交换磁盘上的文件大小和内核文件大小，如果调用程序以非零偏移传递，则该做法是不正确的。混淆了文件大小后，PoC 对看似未引用链接的单块文件使用第二个交换范围调用。
    由于文件大小设置不正确，exchange-range 认为其正在交换两个文件的完整内容，并清除已损坏文件上的 reflink 标记。这可允许对损坏文件进行扩展写入，以重写刚刚过 EOF 的共享区块。这已通俗地称为反流。正确设置文件大小后，第二个交换范围将不再认为其正在进行完整内容交换，因此不会清除其任一文件参数上的 reflink 标记。Norbert 在此修补程序的较早版本之后又提出了关于我们未正确处理 i_disk_size 状态的第二个投诉：> 偏移与内核i_size绑定，但会从>减去 ---truncated--- （CVE-2026-98974）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - xfs:exchange-range-to-eof ファイルサイズ交換を修正します Norbert Szetei 氏は、XFS_IOC_EXCHANGE_RANGE の TO_EOF フラグにあるバグについての不完全な説明を含むパッチを投稿しました。このバグは、exchange-range が騙されて、EOF を超えて開始するブロックを共有できるようにファイルを変更させます。ファイルには EOF を超えて書き込まれたデータはなく、書き込みされたデータブロックしか共有できないため、これは決して許可されません。これが、その後に起こるすべての誤った動作の鍵となります。最終的に、私はノーバートから何が起こっているのか、つまり「>フェア」という説明をもらいました。ここに物理ブロック番号、4kブロックがあります。peer は書き換えられるファイル>であり、file1 はフラグがクリアされた状態で終了するファイル>です。> > 開始、何も共有されません:> > ピアサイズ 4096 -> [100] > file1 サイズ 12288 -> [200] [201] [202] > donor1 サイズ 4096 -> [300] > donor2 サイズ 4096 -> [400] > > 1.file1 の中間スロットへの FICLONERANGE ピアのブロック:> > ピアサイズ 4096 -> [100] > file1 サイズ 12288 -> [200] [100] [202] reflink フラグセット > ^^^^^ 両方のファイルがブロック 100 > > 2 を所有します。XFS_IOC_EXCHANGE_RANGE donor1 に対する file1、file1_offset 0、> file2_offset 8192、長さ 0、TO_EOF。1 つのブロックが交換され、>のサイズがそれと交換されます:> > file1 サイズ 4096 -> [200] [100] [300] reflink フラグセット > ^^^^^^^^^^^ はまだ所有されていますが、現在は donor1 のサイズを超えています > サイズ 12288 -> [202] > > file1 はまだ 3 つを所有しているのに、長さは 1 ブロックだと言います。マッピング解除>ものは何もありませんでした。file2_offsetはブロック 2 であるため、この交換はフラグをクリアできません。> > 3.
    XFS_IOC_EXCHANGE_RANGE donor2 に対する file1、両方のオフセット 0、長さ 4096。> i_disk_sizeにより、これは 2 つの 1 ブロックのファイルがすべてを交換することになります。このため、> xmi_can_exchange_reflink_flags() が同意し、フラグがクリアされます:> > file1 サイズ 4096 -> [400] [100] [300] reflink フラグが donor2 サイズ 4096 >クリアされました -> [200] > > ブロック 100 は依然としてピアと共有されています。> > 4.pwrite(file1, 4096, 4096) であり、file1 の 2 番目のスロットであるブロック 100 です。> xfs_is_cow_inode(file1) は false であるため、CoW はありません:ピアサイズ 4096 > > -> [100] 同じブロック、ブロック 100 > >新しいコンテンツだけがここで重要です。PoCでは、現在のディレクトリのpeerと呼ばれるファイル>読み込みます。ファイルシステムには、reflink と > exchange-range が必要で、mkfs.xfs 7.x デフォルトでこれをオンにします。そう、実際にはデータブロックを正しく交換しているにもかかわらず、TO_EOFファイルサイズを台無しにしています。以下は、man ページで説明されているように、XFS_EXCHANGE_RANGE_TO_EOF の意図された動作です: 長さパラメーターを無視します。file1_offset から EOF までの file1_fd 内のすべてのバイトは file2_fd に移動し、file2 のサイズは (file2_offset+(file1_length-file1_offset)) に設定されます。その間、file2_offsetからEOFまでのfile2のすべてのバイトはfile1に移動し、file1のサイズは(file1_offset+(file2_length-file2_offset))に設定されます。つまり、ファイルデータの一部のみを交換する場合は、交換したデータに関連するファイルサイズの部分のみを交換する必要があります。残念ながら、このコードによりオンディスクファイルサイズとインコアファイルサイズが入れ替わりますが、呼び出し元がゼロ以外のオフセットで渡す場合、これは正しくありません。ファイルサイズを混乱させた結果、PoC は、参照リンクされていないシングルブロックファイルのように見えるものに対して、2 番目の交換範囲呼び出しを使用します。
    ファイルサイズの設定が不適切であるため、exchange-range は 2 つのファイルの完全なコンテンツを交換していると考え、壊れたファイルの reflink フラグを消去します。これにより、破損したファイルの拡張書き込みが有効になり、EOF を過ぎたばかりの共有ブロックを書き換えられます。これは、口語的に refluxfs として知られるようになりました。ファイルサイズが正しく設定されると、第 2 の exchange-range は、フルコンテンツスワップをしているとは考えなくなり、ファイルの引数のどちらかで reflink フラグをクリアしなくなります。Norbert 氏は、このパッチの以前のバージョンにフォローアップして、i_disk_size 状態を適切に処理できていないことに関する第 2 の苦情を提出しました: > オフセットは、インコアi_sizeに対してバインドされますが、> ---truncated--- から差し引かれます(CVE-2026-98974)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-95367 advisory.

    - sunrpc: wait for in-flight TLS handshake callback when cancel loses race (Olga Kornievskaia)     [RHEL-283649] {CVE-2026-72221}
    - sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (Olga Kornievskaia) [RHEL-283263]     {CVE-2026-72222}
    - fs/resctrl: Fix use-after-free during unmount (Dennis Chen) [RHEL-296708] {CVE-2026-72080}
    - xfs: fix exchange-range-to-eof file size exchange (Carlos Maiolino) [RHEL-292986] {CVE-2026-98974}
    - xfs: stop exchanging reflink flags when exchanging mappings (Carlos Maiolino) [RHEL-292986]     {CVE-2026-98974}
    - sctp: clear new_transport when removing a peer (CKI Backport Bot) [RHEL-275369] {CVE-2026-74586}
    - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (Ian Kent) [RHEL-260509]     {CVE-2026-64378}
    - openvswitch: Fix CT limit teardown use-after-free (Timothy Redaelli) [RHEL-263515] {CVE-2026-89488}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:95367 advisory.

    * kernel: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378)

    * kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222)

    * kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221)

    * kernel: fs/resctrl: Fix use-after-free during unmount (CVE-2026-72080)

    * kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)

    * kernel: openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488)

    * kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers (CVE-2026-90315)

    * kernel: kernel: xfs: Unauthorized data modification via improper file size exchange handling     (CVE-2026-98974)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-9018-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - Network file systems library;

    - Stream parser;

    - ARM64 architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - S390 architecture;

    - User-Mode Linux (UML);

    - x86 architecture;

    - Block layer subsystem;

    - Android drivers;

    - Bluetooth drivers;

    - TPM device driver;

    - DPLL subsystem;

    - EDAC drivers;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - IIO subsystem;

    - IIO ADC drivers;

    - InfiniBand drivers;

    - Input Device (Miscellaneous) drivers;

    - Multiple devices driver;

    - MemoryStick subsystem;

    - MMC subsystem;

    - MTD block device drivers;

    - Network drivers;

    - Ethernet bonding driver;

    - Mellanox network drivers;

    - STMicroelectronics network drivers;

    - Ethernet team driver;

    - MediaTek network drivers;

    - NVME drivers;

    - Device tree and open firmware driver;

    - Power sequencing drivers;

    - Voltage and Current Regulator drivers;

    - Real Time Clock drivers;

    - SCSI subsystem;

    - Greybus lights staging drivers;

    - Trusted Execution Environment drivers;

    - Thunderbolt and USB4 drivers;

    - TTY drivers;

    - Cadence USB3 driver;

    - USB Device Class drivers;

    - USB core drivers;

    - DesignWare USB2 driver;

    - DesignWare USB3 driver;

    - USB Gadget drivers;

    - USB Serial drivers;

    - USB Mass Storage drivers;

    - USB Type-C support driver;

    - USB Type-C Port Controller Manager driver;

    - TI TPS6598x USB Power Delivery controller driver;

    - USB Type-C Connector System Software Interface driver;

    - Amazon Nitro Enclaves driver;

    - Virtual machine generation ID driver;

    - BTRFS file system;

    - File systems infrastructure;

    - SMB network file system;

    - XFS file system;

    - BPF subsystem;

    - io_uring subsystem;

    - Netfilter;

    - Namespaces infrastructure;

    - Networking core;

    - Networking subsytem;

    - Virtio network driver;

    - Bluetooth subsystem;

    - IPv4 networking;

    - Network traffic control;

    - Audit subsystem;

    - Control group (cgroup);

    - Perf events;

    - Kernel fork() syscall;

    - Kernel futex primitives;

    - KProbes tracing;

    - Kexec HandOver (KHO);

    - Kernel module support;

    - Tracing infrastructure;

    - Workqueue subsystem;

    - Memory management;

    - Ethernet bridge;

    - Devlink API;

    - IPv6 networking;

    - MAC80211 subsystem;

    - Management Component Transport Protocol (MCTP);

    - Open vSwitch;

    - Packet sockets;

    - SCTP protocol;

    - SMC sockets;

    - TIPC protocol;

    - VMware vSockets driver;

    - Wireless networking;

    - XFRM subsystem;

    - Drivers core;

    - Key management;

    - SELinux security module;

    - ALSA framework;

    - Creative Sound Blaster X-Fi driver;

    - Analog Devices audio codecs;

    - Maxim audio codecs;

    - Realtek audio codecs;

    - QCOM ASoC drivers;

    - Samsung ASoC drivers;

    - SoundWire (SDCA) ASoC drivers;

    - USB sound devices; (CVE-2026-68305, CVE-2026-72404, CVE-2026-72497, CVE-2026-74527, CVE-2026-74568,     CVE-2026-89568, CVE-2026-89764, CVE-2026-89907, CVE-2026-90144, CVE-2026-90155, CVE-2026-90162,     CVE-2026-90167, CVE-2026-90317, CVE-2026-93175, CVE-2026-98038, CVE-2026-98375, CVE-2026-98432,     CVE-2026-98655, CVE-2026-98656, CVE-2026-98657, CVE-2026-98658, CVE-2026-98659, CVE-2026-98660,     CVE-2026-98661, CVE-2026-98662, CVE-2026-98663, CVE-2026-98664, CVE-2026-98665, CVE-2026-98666,     CVE-2026-98667, CVE-2026-98668, CVE-2026-98669, CVE-2026-98670, CVE-2026-98671, CVE-2026-98672,     CVE-2026-98673, CVE-2026-98674, CVE-2026-98675, CVE-2026-98676, CVE-2026-98677, CVE-2026-98678,     CVE-2026-98679, CVE-2026-98680, CVE-2026-98681, CVE-2026-98682, CVE-2026-98683, CVE-2026-98684,     CVE-2026-98685, CVE-2026-98686, CVE-2026-98687, CVE-2026-98689, CVE-2026-98690, CVE-2026-98691,     CVE-2026-98692, CVE-2026-98693, CVE-2026-98694, CVE-2026-98695, CVE-2026-98696, CVE-2026-98697,     CVE-2026-98698, CVE-2026-98699, CVE-2026-98700, CVE-2026-98701, CVE-2026-98702, CVE-2026-98703,     CVE-2026-98704, CVE-2026-98705, CVE-2026-98706, CVE-2026-98707, CVE-2026-98708, CVE-2026-98709,     CVE-2026-98710, CVE-2026-98711, CVE-2026-98712, CVE-2026-98713, CVE-2026-98714, CVE-2026-98715,     CVE-2026-98716, CVE-2026-98717, CVE-2026-98718, CVE-2026-98719, CVE-2026-98720, CVE-2026-98721,     CVE-2026-98722, CVE-2026-98723, CVE-2026-98724, CVE-2026-98725, CVE-2026-98726, CVE-2026-98727,     CVE-2026-98728, CVE-2026-98729, CVE-2026-98730, CVE-2026-98731, CVE-2026-98732, CVE-2026-98733,     CVE-2026-98734, CVE-2026-98735, CVE-2026-98736, CVE-2026-98737, CVE-2026-98738, CVE-2026-98739,     CVE-2026-98740, CVE-2026-98741, CVE-2026-98742, CVE-2026-98743, CVE-2026-98744, CVE-2026-98745,     CVE-2026-98746, CVE-2026-98747, CVE-2026-98748, CVE-2026-98749, CVE-2026-98750, CVE-2026-98751,     CVE-2026-98752, CVE-2026-98753, CVE-2026-98754, CVE-2026-98755, CVE-2026-98756, CVE-2026-98757,     CVE-2026-98758, CVE-2026-98759, CVE-2026-98760, CVE-2026-98761, CVE-2026-98762, CVE-2026-98763,     CVE-2026-98764, CVE-2026-98765, CVE-2026-98766, CVE-2026-98767, CVE-2026-98768, CVE-2026-98769,     CVE-2026-98770, CVE-2026-98771, CVE-2026-98772, CVE-2026-98773, CVE-2026-98774, CVE-2026-98775,     CVE-2026-98776, CVE-2026-98777, CVE-2026-98778, CVE-2026-98779, CVE-2026-98780, CVE-2026-98781,     CVE-2026-98782, CVE-2026-98783, CVE-2026-98784, CVE-2026-98785, CVE-2026-98786, CVE-2026-98788,     CVE-2026-98789, CVE-2026-98790, CVE-2026-98791, CVE-2026-98792, CVE-2026-98793, CVE-2026-98794,     CVE-2026-98795, CVE-2026-98796, CVE-2026-98797, CVE-2026-98798, CVE-2026-98799, CVE-2026-98800,     CVE-2026-98801, CVE-2026-98802, CVE-2026-98803, CVE-2026-98804, CVE-2026-98805, CVE-2026-98806,     CVE-2026-98807, CVE-2026-98808, CVE-2026-98809, CVE-2026-98810, CVE-2026-98811, CVE-2026-98812,     CVE-2026-98813, CVE-2026-98814, CVE-2026-98816, CVE-2026-98817, CVE-2026-98818, CVE-2026-98819,     CVE-2026-98820, CVE-2026-98821, CVE-2026-98822, CVE-2026-98823, CVE-2026-98824, CVE-2026-98825,     CVE-2026-98826, CVE-2026-98827, CVE-2026-98828, CVE-2026-98829, CVE-2026-98830, CVE-2026-98831,     CVE-2026-98833, CVE-2026-98834, CVE-2026-98835, CVE-2026-98836, CVE-2026-98837, CVE-2026-98838,     CVE-2026-98839, CVE-2026-98840, CVE-2026-98841, CVE-2026-98842, CVE-2026-98843, CVE-2026-98844,     CVE-2026-98845, CVE-2026-98846, CVE-2026-98847, CVE-2026-98848, CVE-2026-98849, CVE-2026-98850,     CVE-2026-98851, CVE-2026-98852, CVE-2026-98853, CVE-2026-98854, CVE-2026-98855, CVE-2026-98856,     CVE-2026-98857, CVE-2026-98858, CVE-2026-98859, CVE-2026-98860, CVE-2026-98861, CVE-2026-98862,     CVE-2026-98863, CVE-2026-98931, CVE-2026-98932, CVE-2026-98933, CVE-2026-98934, CVE-2026-98935,     CVE-2026-98936, CVE-2026-98937, CVE-2026-98939, CVE-2026-98940, CVE-2026-98944, CVE-2026-98945,     CVE-2026-98946, CVE-2026-98947, CVE-2026-98948, CVE-2026-98949, CVE-2026-98950, CVE-2026-98951,     CVE-2026-98952, CVE-2026-98953, CVE-2026-98954, CVE-2026-98955, CVE-2026-98956, CVE-2026-98957,     CVE-2026-98958, CVE-2026-98959, CVE-2026-98960, CVE-2026-98961, CVE-2026-98962, CVE-2026-98963,     CVE-2026-98964, CVE-2026-98965, CVE-2026-98966, CVE-2026-98967, CVE-2026-98968, CVE-2026-98969,     CVE-2026-98970, CVE-2026-98971, CVE-2026-98972, CVE-2026-98973, CVE-2026-98974, CVE-2026-98975,     CVE-2026-98977, CVE-2026-98978, CVE-2026-98979, CVE-2026-98980, CVE-2026-98981, CVE-2026-98982,     CVE-2026-98983, CVE-2026-98984, CVE-2026-98985, CVE-2026-98986, CVE-2026-98987, CVE-2026-98988,     CVE-2026-98989, CVE-2026-98990, CVE-2026-98991, CVE-2026-98992, CVE-2026-98993, CVE-2026-98994,     CVE-2026-98995, CVE-2026-98996, CVE-2026-98997, CVE-2026-98999, CVE-2026-99000, CVE-2026-99001,     CVE-2026-99002, CVE-2026-99003, CVE-2026-99004, CVE-2026-99005, CVE-2026-99006, CVE-2026-99007,     CVE-2026-99008, CVE-2026-99009, CVE-2026-99010, CVE-2026-99011, CVE-2026-99012, CVE-2026-99013,     CVE-2026-99014, CVE-2026-99015, CVE-2026-99016, CVE-2026-99017, CVE-2026-99018, CVE-2026-99019,     CVE-2026-99020, CVE-2026-99021, CVE-2026-99022, CVE-2026-99023, CVE-2026-99024, CVE-2026-99025,     CVE-2026-99026, CVE-2026-99027, CVE-2026-99028, CVE-2026-99029, CVE-2026-99030, CVE-2026-99031,     CVE-2026-99032, CVE-2026-99033, CVE-2026-99034, CVE-2026-99035, CVE-2026-99036, CVE-2026-99037,     CVE-2026-99038, CVE-2026-99039, CVE-2026-99040, CVE-2026-99041, CVE-2026-99043, CVE-2026-99044,     CVE-2026-99045, CVE-2026-99046, CVE-2026-99047, CVE-2026-99048, CVE-2026-99049, CVE-2026-99050,     CVE-2026-99051, CVE-2026-99052, CVE-2026-99053, CVE-2026-99054, CVE-2026-99055, CVE-2026-99056,     CVE-2026-99057, CVE-2026-99058, CVE-2026-99059, CVE-2026-99060, CVE-2026-99061, CVE-2026-99062,     CVE-2026-99063, CVE-2026-99064, CVE-2026-99065, CVE-2026-99066, CVE-2026-99067, CVE-2026-99068,     CVE-2026-99069, CVE-2026-99070, CVE-2026-99071, CVE-2026-99072, CVE-2026-99073, CVE-2026-99074,     CVE-2026-99075, CVE-2026-99076, CVE-2026-99077, CVE-2026-99078, CVE-2026-99079, CVE-2026-99080,     CVE-2026-99081, CVE-2026-99088, CVE-2026-99089, CVE-2026-99090, CVE-2026-99091, CVE-2026-99092,     CVE-2026-99093, CVE-2026-99094, CVE-2026-99095, CVE-2026-99096, CVE-2026-99097, CVE-2026-99098,     CVE-2026-99099, CVE-2026-99999)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range-to-eof file     size exchange Norbert Szetei posted a patch containing an incomplete description of a bug in     XFS_IOC_EXCHANGE_RANGE's TO_EOF flag. The bug tricks exchange-range into modifying a file so that it has     shared blocks starting beyond EOF, which is never allowed because files never have written data beyond     EOF, and you can only share written data blocks. This is key to all the incorrect behavior that follows.
    Eventually I got from Norbert a description of what's going wrong: > Fair. Here it is with physical block     numbers, 4k blocks. peer is the file > that gets rewritten and file1 is the one that ends up with the flag     > cleared. > > Start, nothing shared: > > peer size 4096 -> [100] > file1 size 12288 -> [200] [201] [202]     > donor1 size 4096 -> [300] > donor2 size 4096 -> [400] > > 1. FICLONERANGE peer's block into file1's     middle slot: > > peer size 4096 -> [100] > file1 size 12288 -> [200] [100] [202] reflink flag set > ^^^^^     both files own block 100 > > 2. XFS_IOC_EXCHANGE_RANGE file1 against donor1, file1_offset 0, >     file2_offset 8192, length 0, TO_EOF. One block is exchanged, and the sizes > are exchanged with it: > >     file1 size 4096 -> [200] [100] [300] reflink flag set > ^^^^^^^^^^^ still owned, now past the size >     donor1 size 12288 -> [202] > > file1 says it is one block long while it still owns three. Nothing was >     unmapped. file2_offset is block 2, so this exchange cannot clear a flag. > > 3. XFS_IOC_EXCHANGE_RANGE     file1 against donor2, both offsets 0, length 4096. > By i_disk_size this is two one-block files exchanging     everything, so > xmi_can_exchange_reflink_flags() agrees and the flag is cleared: > > file1 size 4096 ->     [400] [100] [300] reflink flag CLEARED > donor2 size 4096 -> [200] > > Block 100 is still shared with     peer. > > 4. pwrite(file1, 4096, 4096), which is file1's second slot, block 100. > xfs_is_cow_inode(file1)     is false, so no CoW: > > peer size 4096 -> [100] same block, new contents > > Block 100 is the only one     that matters here. PoC below, it reads a file > called peer in the current directory. The filesystem needs     reflink and > exchange-range, which mkfs.xfs 7.x turns on by default. So yes, TO_EOF is screwing up the     file size even if it's actually exchanging the data block correctly. The following is the intended     behavior of XFS_EXCHANGE_RANGE_TO_EOF, as described by its manpage: Ignore the length parameter. All     bytes in file1_fd from file1_offset to EOF are moved to file2_fd, and file2's size is set to     (file2_offset+(file1_length-file1_offset)). Meanwhile, all bytes in file2 from file2_offset to EOF are     moved to file1 and file1's size is set to (file1_offset+(file2_length-file2_offset)). In other words, if     we only exchange a portion of the file data, then we should only exchange the portion of the file size     that relates to the exchanged data. Unfortunately, the code swaps the ondisk file size and the incore file     sizes, which is incorrect if the caller passes in a nonzero offset. Having confused the file sizes, the     PoC uses a second exchange-range call on what looks like a non-reflinked single-block file. Because the     file size is set incorrectly, exchange-range thinks it's exchanging the full contents of two files and     clears the reflink flag on the broken file. That enables an extending write of the broken file to rewrite     the shared block that's just past EOF. This has become known colloquially as refluxfs. Once the file sizes     are set correctly, the second exchange-range no longer thinks that it's doing a full-contents swap, so it     won't clear the reflink flag on either of its file arguments. Norbert followed up to an earlier version of     this patch with a second complaint about us not handling the i_disk_size state correctly: > The offsets     are bounded against the incore i_size but subtracted from > ---truncated--- (CVE-2026-98974)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_95367 advisory.

    * kernel: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378)

    * kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222)

    * kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221)

    * kernel: fs/resctrl: Fix use-after-free during unmount (CVE-2026-72080)

    * kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)

    * kernel: openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488)

    * kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers (CVE-2026-90315)

    * kernel: kernel: xfs: Unauthorized data modification via improper file size exchange handling     (CVE-2026-98974)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:98608 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors (CVE-2024-57793)

    * kernel: OPP: add index check to assert to avoid buffer overflow in _read_freq() (CVE-2024-57998)

    * kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)

    * kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)

    * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)

    * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)

    * kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076)

    * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176)

    * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

    * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)

    * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264)

    * kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)

    * kernel: vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365)

    * kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398)

    * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

    * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388)

    * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)

    * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962)

    * kernel: vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970)

    * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)

    * kernel: vfio/pci: Check BAR resources before exporting a DMABUF (CVE-2026-64042)

    * kernel: vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)

    * kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)

    * kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)

    * kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)

    * kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)

    * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

    * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)

    * kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)

    * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)

    * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

    * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)

    * kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)

    * kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)

    * kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)

    * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)

    * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)

    * kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317)

    * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)

    * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509)

    * kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)

    * kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574)

    * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

    * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

    * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)

    * kernel: af_unix: Unlink scc_entry in unix_del_edge() (CVE-2026-80521)

    * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

    * kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

    * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)

    * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

    * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

    * kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)

    * kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF (CVE-2026-89690)

    * kernel: nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669)

    * kernel: net: tun: bound receive headroom (CVE-2026-81000)

    * kernel: svcrdma: Reject inline replies that overflow the pull-up buffer (CVE-2026-89530)

    * kernel: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (CVE-2026-89676)

    * kernel: nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663)

    * kernel: nfsd: fix UAF in async copy cancel and shutdown (CVE-2026-89675)

    * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)

    * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)

    * kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)

    * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)

    * kernel: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (CVE-2026-89775)

    * kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)

    * kernel: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (CVE-2026-89791)

    * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

    * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

    * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)

    * kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)

    * kernel: scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame (CVE-2026-90008)

    * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

    * kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

    * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

    * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)

    * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

    * kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

    * kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)

    * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)

    * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)

    * kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation ()

    * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)

    * kernel: signal: Prevent exec() race (CVE-2026-98256)

    * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)

    * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260)

    * kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320)

    * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)

    * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

    * kernel: kernel: xfs: Unauthorized data modification via improper file size exchange handling     (CVE-2026-98974)

    * kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege     Escalation Vulnerability ()

    Bug Fix(es) and Enhancement(s):

    * [HPEMC RHEL 10.3 BUG] bnxt_en: Fix NULL pointer dereference (JIRA:RHEL-185083)

    * netfilter: rebase to 7.2 (JIRA:RHEL-242582)

    * [Intel 10.3 FEAT] idpf: Driver Update [rhel-10.3.z] (JIRA:RHEL-248077)

    * RHEL 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [rhel-10.3.z]     (JIRA:RHEL-254106)

    * cannot use VFs of i40e/ice NIC in bond device (JIRA:RHEL-276751)

    * [EC2][CVM]AMD SEV-SNP guest hangs during early boot on RHEL 10.3 and 10.4 (regression from 10.2)     [rhel-10.3.z] (JIRA:RHEL-283382)

    * backport fixes for lockdep issues reported with rt-debug [rhel-10.3.z] (JIRA:RHEL-259938)

    * [RHEL 10] fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal     [rhel-10.3.z] (JIRA:RHEL-284384)

    * RHEL is missing support for conntrack zone filtering in dump/delete requests (10.4) [rhel-10.3.z]     (JIRA:RHEL-291349)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4904 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4904-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     November 13, 2026                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-6.12     Version        : 6.12.115-2~deb12u1     CVE ID         : CVE-2024-58074 CVE-2025-22109 CVE-2025-23132 CVE-2025-23135                      CVE-2025-37743 CVE-2025-37746 CVE-2025-37906 CVE-2025-38029                      CVE-2025-38041 CVE-2025-38042 CVE-2025-38064 CVE-2025-38132                      CVE-2025-38137 CVE-2025-38140 CVE-2025-38187 CVE-2025-38199                      CVE-2025-38207 CVE-2025-38261 CVE-2025-38284 CVE-2025-38359                      CVE-2025-38421 CVE-2025-38597 CVE-2025-38605 CVE-2025-38636                      CVE-2025-38656 CVE-2025-39677 CVE-2025-39775 CVE-2025-39789                      CVE-2025-39830 CVE-2025-39834 CVE-2025-39859 CVE-2025-39862                      CVE-2025-39910 CVE-2025-39933 CVE-2025-39958 CVE-2025-40065                      CVE-2025-40086 CVE-2025-40113 CVE-2025-40130 CVE-2025-40136                      CVE-2025-40338 CVE-2025-40355 CVE-2025-68174 CVE-2025-68193                      CVE-2025-68209 CVE-2025-68236 CVE-2025-68318 CVE-2025-68319                      CVE-2025-68353 CVE-2025-68359 CVE-2025-68360 CVE-2025-68368                      CVE-2025-68376 CVE-2025-68729 CVE-2025-68730 CVE-2025-68735                      CVE-2025-68745 CVE-2025-68755 CVE-2025-71074 CVE-2025-71141                      CVE-2025-71227 CVE-2025-71285 CVE-2025-71313 CVE-2026-23007                      CVE-2026-23017 CVE-2026-23143 CVE-2026-23208 CVE-2026-23217                      CVE-2026-23259 CVE-2026-23327 CVE-2026-23371 CVE-2026-23377                      CVE-2026-23385 CVE-2026-23472 CVE-2026-31493 CVE-2026-31526                      CVE-2026-31562 CVE-2026-31579 CVE-2026-31592 CVE-2026-31630                      CVE-2026-31771 CVE-2026-43009 CVE-2026-43022 CVE-2026-43034                      CVE-2026-43042 CVE-2026-43048 CVE-2026-43053 CVE-2026-43083                      CVE-2026-43101 CVE-2026-43118 CVE-2026-43127 CVE-2026-43172                      CVE-2026-43185 CVE-2026-43191 CVE-2026-43204 CVE-2026-43213                      CVE-2026-43234 CVE-2026-43263 CVE-2026-43272 CVE-2026-43294                      CVE-2026-43298 CVE-2026-43299 CVE-2026-43308 CVE-2026-43309                      CVE-2026-43310 CVE-2026-43311 CVE-2026-43325 CVE-2026-43337                      CVE-2026-43346 CVE-2026-43352 CVE-2026-43353 CVE-2026-43414                      CVE-2026-43443 CVE-2026-43463 CVE-2026-43464 CVE-2026-43465                      CVE-2026-43485 CVE-2026-45932 CVE-2026-45934 CVE-2026-45940                      CVE-2026-45956 CVE-2026-45961 CVE-2026-46014 CVE-2026-46032                      CVE-2026-46044 CVE-2026-46059 CVE-2026-46066 CVE-2026-46071                      CVE-2026-46130 CVE-2026-46148 CVE-2026-46171 CVE-2026-46175                      CVE-2026-46181 CVE-2026-46228 CVE-2026-46245 CVE-2026-46256                      CVE-2026-46272 CVE-2026-46302 CVE-2026-46324 CVE-2026-46325                      CVE-2026-46330 CVE-2026-52937 CVE-2026-52956 CVE-2026-52983                      CVE-2026-52991 CVE-2026-53000 CVE-2026-53009 CVE-2026-53017                      CVE-2026-53018 CVE-2026-53024 CVE-2026-53025 CVE-2026-53091                      CVE-2026-53103 CVE-2026-53104 CVE-2026-53108 CVE-2026-53109                      CVE-2026-53118 CVE-2026-53178 CVE-2026-53224 CVE-2026-53258                      CVE-2026-53277 CVE-2026-53281 CVE-2026-53284 CVE-2026-53285                      CVE-2026-53292 CVE-2026-53297 CVE-2026-53321 CVE-2026-53330                      CVE-2026-53368 CVE-2026-53377 CVE-2026-53401 CVE-2026-63811                      CVE-2026-63825 CVE-2026-63832 CVE-2026-63853 CVE-2026-63857                      CVE-2026-63859 CVE-2026-63879 CVE-2026-63979 CVE-2026-63998                      CVE-2026-63999 CVE-2026-64006 CVE-2026-64024 CVE-2026-64036                      CVE-2026-64038 CVE-2026-64060 CVE-2026-64068 CVE-2026-64076                      CVE-2026-64077 CVE-2026-64079 CVE-2026-64117 CVE-2026-64146                      CVE-2026-64154 CVE-2026-64159 CVE-2026-64190 CVE-2026-64213                      CVE-2026-64283 CVE-2026-64388 CVE-2026-64389 CVE-2026-64400                      CVE-2026-64513 CVE-2026-68081 CVE-2026-68105 CVE-2026-68211                      CVE-2026-68233 CVE-2026-68238 CVE-2026-68241 CVE-2026-68242                      CVE-2026-68258 CVE-2026-68291 CVE-2026-68295 CVE-2026-68312                      CVE-2026-68323 CVE-2026-68375 CVE-2026-68383 CVE-2026-68393                      CVE-2026-68399 CVE-2026-68400 CVE-2026-68401 CVE-2026-68404                      CVE-2026-68409 CVE-2026-68412 CVE-2026-68418 CVE-2026-68421                      CVE-2026-68426 CVE-2026-68435 CVE-2026-68436 CVE-2026-68441                      CVE-2026-68447 CVE-2026-68448 CVE-2026-68453 CVE-2026-68470                      CVE-2026-68471 CVE-2026-72009 CVE-2026-72031 CVE-2026-72073                      CVE-2026-72098 CVE-2026-72162 CVE-2026-72288 CVE-2026-72321                      CVE-2026-72329 CVE-2026-72337 CVE-2026-72341 CVE-2026-72366                      CVE-2026-72367 CVE-2026-72375 CVE-2026-72380 CVE-2026-72383                      CVE-2026-72388 CVE-2026-72397 CVE-2026-72398 CVE-2026-72404                      CVE-2026-72423 CVE-2026-72439 CVE-2026-72440 CVE-2026-72488                      CVE-2026-72493 CVE-2026-72494 CVE-2026-72495 CVE-2026-72497                      CVE-2026-72499 CVE-2026-72500 CVE-2026-72501 CVE-2026-74257                      CVE-2026-74261 CVE-2026-74264 CVE-2026-74269 CVE-2026-74272                      CVE-2026-74273 CVE-2026-74317 CVE-2026-74338 CVE-2026-74344                      CVE-2026-74350 CVE-2026-74368 CVE-2026-74373 CVE-2026-74374                      CVE-2026-74375 CVE-2026-74385 CVE-2026-74388 CVE-2026-74405                      CVE-2026-74407 CVE-2026-74449 CVE-2026-74466 CVE-2026-74506                      CVE-2026-74513 CVE-2026-74520 CVE-2026-74527 CVE-2026-74529                      CVE-2026-74530 CVE-2026-74533 CVE-2026-74537 CVE-2026-74538                      CVE-2026-74542 CVE-2026-74544 CVE-2026-74558 CVE-2026-74559                      CVE-2026-74571 CVE-2026-74600 CVE-2026-74605 CVE-2026-74611                      CVE-2026-74687 CVE-2026-74690 CVE-2026-74695 CVE-2026-74697                      CVE-2026-74711 CVE-2026-74713 CVE-2026-74715 CVE-2026-74723                      CVE-2026-74728 CVE-2026-74729 CVE-2026-74733 CVE-2026-74734                      CVE-2026-74747 CVE-2026-74752 CVE-2026-74754 CVE-2026-80581                      CVE-2026-80607 CVE-2026-80614 CVE-2026-80616 CVE-2026-80623                      CVE-2026-80628 CVE-2026-80631 CVE-2026-80634 CVE-2026-80643                      CVE-2026-80653 CVE-2026-80655 CVE-2026-80662 CVE-2026-80668                      CVE-2026-80692 CVE-2026-80693 CVE-2026-80698 CVE-2026-80705                      CVE-2026-80734 CVE-2026-80738 CVE-2026-80747 CVE-2026-80761                      CVE-2026-80786 CVE-2026-80866 CVE-2026-80884 CVE-2026-80905                      CVE-2026-80920 CVE-2026-80948 CVE-2026-89528 CVE-2026-89534                      CVE-2026-89537 CVE-2026-89601 CVE-2026-89631 CVE-2026-89642                      CVE-2026-89648 CVE-2026-89654 CVE-2026-89682 CVE-2026-89705                      CVE-2026-89709 CVE-2026-89757 CVE-2026-89788 CVE-2026-89808                      CVE-2026-89810 CVE-2026-89811 CVE-2026-89812 CVE-2026-89813                      CVE-2026-89833 CVE-2026-89906 CVE-2026-89913 CVE-2026-89920                      CVE-2026-89987 CVE-2026-90061 CVE-2026-90083 CVE-2026-90084                      CVE-2026-90086 CVE-2026-90087 CVE-2026-90093 CVE-2026-90097                      CVE-2026-90099 CVE-2026-90104 CVE-2026-90105 CVE-2026-90106                      CVE-2026-90111 CVE-2026-90116 CVE-2026-90142 CVE-2026-90144                      CVE-2026-90149 CVE-2026-90154 CVE-2026-90155 CVE-2026-90156                      CVE-2026-90161 CVE-2026-90162 CVE-2026-90167 CVE-2026-90174                      CVE-2026-90177 CVE-2026-90179 CVE-2026-90182 CVE-2026-90183                      CVE-2026-90204 CVE-2026-90205 CVE-2026-90206 CVE-2026-90208                      CVE-2026-90217 CVE-2026-90231 CVE-2026-90232 CVE-2026-90234                      CVE-2026-90240 CVE-2026-90247 CVE-2026-90256 CVE-2026-90259                      CVE-2026-90260 CVE-2026-90263 CVE-2026-90264 CVE-2026-90265                      CVE-2026-90267 CVE-2026-90273 CVE-2026-90289 CVE-2026-90300                      CVE-2026-90301 CVE-2026-90311 CVE-2026-90320 CVE-2026-90321                      CVE-2026-90324 CVE-2026-90326 CVE-2026-90328 CVE-2026-90330                      CVE-2026-90333 CVE-2026-90335 CVE-2026-90336 CVE-2026-90337                      CVE-2026-90343 CVE-2026-90345 CVE-2026-90346 CVE-2026-90347                      CVE-2026-90351 CVE-2026-90359 CVE-2026-90363 CVE-2026-90365                      CVE-2026-90367 CVE-2026-90408 CVE-2026-90409 CVE-2026-90417                      CVE-2026-90421 CVE-2026-90422 CVE-2026-90424 CVE-2026-90427                      CVE-2026-92480 CVE-2026-92482 CVE-2026-92485 CVE-2026-92503                      CVE-2026-92520 CVE-2026-93058 CVE-2026-93081 CVE-2026-93100                      CVE-2026-93104 CVE-2026-93105 CVE-2026-93116 CVE-2026-93122                      CVE-2026-93125 CVE-2026-93129 CVE-2026-93144 CVE-2026-93146                      CVE-2026-93148 CVE-2026-93168 CVE-2026-93175 CVE-2026-93176                      CVE-2026-93181 CVE-2026-93202 CVE-2026-93216 CVE-2026-93221                      CVE-2026-93230 CVE-2026-93251 CVE-2026-93260 CVE-2026-93272                      CVE-2026-93282 CVE-2026-97422 CVE-2026-97424 CVE-2026-97432                      CVE-2026-97477 CVE-2026-97478 CVE-2026-97479 CVE-2026-97480                      CVE-2026-97493 CVE-2026-97501 CVE-2026-97503 CVE-2026-97513                      CVE-2026-97515 CVE-2026-97538 CVE-2026-97554 CVE-2026-97561                      CVE-2026-97928 CVE-2026-97960 CVE-2026-97962 CVE-2026-97975                      CVE-2026-97988 CVE-2026-97989 CVE-2026-97997 CVE-2026-98003                      CVE-2026-98019 CVE-2026-98032 CVE-2026-98033 CVE-2026-98034                      CVE-2026-98038 CVE-2026-98043 CVE-2026-98044 CVE-2026-98047                      CVE-2026-98048 CVE-2026-98049 CVE-2026-98053 CVE-2026-98058                      CVE-2026-98062 CVE-2026-98067 CVE-2026-98073 CVE-2026-98079                      CVE-2026-98084 CVE-2026-98085 CVE-2026-98099 CVE-2026-98124                      CVE-2026-98131 CVE-2026-98134 CVE-2026-98147 CVE-2026-98148                      CVE-2026-98156 CVE-2026-98916 CVE-2026-98974 CVE-2026-98975                      CVE-2026-98977 CVE-2026-98981 CVE-2026-98985 CVE-2026-98993                      CVE-2026-99002 CVE-2026-99009 CVE-2026-99014 CVE-2026-99019                      CVE-2026-99027 CVE-2026-99028 CVE-2026-99041 CVE-2026-99044                      CVE-2026-99077 CVE-2026-99082 CVE-2026-99083 CVE-2026-99085                      CVE-2026-99092 CVE-2026-99098 CVE-2026-99100 CVE-2026-99103                      CVE-2026-99105 CVE-2026-99106 CVE-2026-99110 CVE-2026-99112                      CVE-2026-99113 CVE-2026-99114 CVE-2026-99115 CVE-2026-99117                      CVE-2026-99118 CVE-2026-99121 CVE-2026-99123 CVE-2026-99124                      CVE-2026-99126 CVE-2026-99127 CVE-2026-99128 CVE-2026-99130                      CVE-2026-99131 CVE-2026-99132 CVE-2026-99133 CVE-2026-99134                      CVE-2026-99135 CVE-2026-99136 CVE-2026-99138 CVE-2026-99139                      CVE-2026-99140 CVE-2026-99142 CVE-2026-99143 CVE-2026-99147                      CVE-2026-99150 CVE-2026-99152 CVE-2026-99153 CVE-2026-99154                      CVE-2026-99155 CVE-2026-99156 CVE-2026-99157 CVE-2026-99158                      CVE-2026-99159 CVE-2026-99160 CVE-2026-99161 CVE-2026-99163                      CVE-2026-99165 CVE-2026-99166 CVE-2026-99167 CVE-2026-99169                      CVE-2026-99171 CVE-2026-99173 CVE-2026-99174 CVE-2026-99175                      CVE-2026-99176 CVE-2026-99178 CVE-2026-99179 CVE-2026-99180                      CVE-2026-99181 CVE-2026-99182 CVE-2026-99187 CVE-2026-99191                      CVE-2026-99192 CVE-2026-99201 CVE-2026-99202 CVE-2026-99203                      CVE-2026-99204 CVE-2026-99206 CVE-2026-99211 CVE-2026-99212                      CVE-2026-99213 CVE-2026-99214 CVE-2026-99216 CVE-2026-99218                      CVE-2026-99219 CVE-2026-99220 CVE-2026-99221 CVE-2026-99222                      CVE-2026-99223 CVE-2026-99224 CVE-2026-99225 CVE-2026-99226                      CVE-2026-99227 CVE-2026-99228 CVE-2026-99229 CVE-2026-99230                      CVE-2026-99231 CVE-2026-99233 CVE-2026-99234 CVE-2026-99235                      CVE-2026-99236 CVE-2026-99239 CVE-2026-99244 CVE-2026-99245                      CVE-2026-99246 CVE-2026-99247 CVE-2026-99249 CVE-2026-99250                      CVE-2026-99251 CVE-2026-99254 CVE-2026-99255 CVE-2026-99256                      CVE-2026-99258 CVE-2026-99284 CVE-2026-99285 CVE-2026-100072                      CVE-2026-100074 CVE-2026-100076 CVE-2026-100077     Debian Bug     : 1112238 1151097 1151281

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 12 bookworm, these problems have been fixed in version     6.12.115-2~deb12u1.  This update additionally includes many more bug     fixes from stable updates 6.12.114 and 6.12.115.

    We recommend that you upgrade your linux-6.12 packages.

    For the detailed security status of linux-6.12 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-6.12

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:95367 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378)

    * kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222)

    * kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221)

    * kernel: fs/resctrl: Fix use-after-free during unmount (CVE-2026-72080)

    * kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)

    * kernel: openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488)

    * kernel: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers (CVE-2026-90315)

    * kernel: kernel: xfs: Unauthorized data modification via improper file size exchange handling     (CVE-2026-98974)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
371499	Linux Distros 未修補弱點：CVE-2026-98974	Nessus	Misc.	2026/10/23	2026/11/13	high
371499	Linux Distros 未修补的漏洞：CVE-2026-98974	Nessus	Misc.	2026/10/23	2026/11/13	high
371499	Linux Distros のパッチ未適用の脆弱性: CVE-2026-98974	Nessus	Misc.	2026/10/23	2026/11/13	high
377900	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3402)	Nessus	Amazon Linux Local Security Checks	2026/11/9	2026/11/11	high
376521	Oracle Linux 10 : kernel (ELSA-2026-95367)	Nessus	Oracle Linux Local Security Checks	2026/11/5	2026/11/5	critical
377032	RockyLinux 10 : kernel (RLSA-2026:95367)	Nessus	Rocky Linux Local Security Checks	2026/11/6	2026/11/6	critical
381339	Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-9018-1)	Nessus	Ubuntu Local Security Checks	2026/11/14	2026/11/14	critical
371499	Linux Distros Unpatched Vulnerability : CVE-2026-98974	Nessus	Misc.	2026/10/23	2026/11/13	high
377500	Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_95367)	Nessus	Rocky Linux Local Security Checks	2026/11/7	2026/11/7	critical
378846	RHEL 10 : kernel (RHSA-2026:98608)	Nessus	Red Hat Local Security Checks	2026/11/11	2026/11/12	high
380301	Debian dla-4904 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	2026/11/13	2026/11/13	high
376934	RHEL 10 : kernel (RHSA-2026:95367)	Nessus	Red Hat Local Security Checks	2026/11/6	2026/11/6	critical

偵測

搜尋 Plugin

high

high

high

high

critical

critical

critical

high

critical

high

high

critical