Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - VSOCK/VMCI：驗證已連線通訊端的封包來源 vmci_transport_recv_stream_cb（） 會先依完整的來源和目的地元組查詢通訊端，然後僅依繫結表格中的目的地查詢通訊端。後援可以選取非接聽通訊端，而不檢查封包是否來自其儲存的對等。這是使用兩個 VMCI 上下文重現的。來自內容的 RST 未儲存在 TCP_SYN_SENT 通訊端中，會在僅限目的地查詢選取之後重設該通訊端。當通訊端不屬於使用者內容時，VMCI 可以在下半部內容中處理通知封包，或將封包延遲至工作佇列。在下半部分路徑中進行通訊端鎖定後使用 vsock_check_source（），並在工作佇列路徑中的 lock_sock（） 之後重新檢查。接聽通訊端會繼續接受來自任何來源的封包。在丟棄驗證失敗的來源之前，使用從收到的封包定址的 RST 回覆。這會保留繫結、非接聽和同時關閉通訊端的現有重設行為，而不會將重設導向至已連接通訊端的儲存對等。（CVE-2026-99122）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - vsock/vmci：验证已连接套接字的数据包源 vmci_transport_recv_stream_cb（） 首先按完整源元组和目标元组查找套接字，然后仅按绑定表中的目标查找套接字。回退可选择不监听的套接字，而不会检查数据包是否来自其存储的对等方。这通过两种 VMCI 上下文再现。未存储在 TCP_SYN_SENT 套接字中的上下文中的 RST，在通过仅限目标查找选择之后会重置该套接字。当套接字不归用户上下文所有时，VMCI 可以在下半部分上下文中处理通知数据包，或者将数据包延迟到工作队列。在下半部分路径中进行套接字锁定之后使用 vsock_check_source（），并在工作队列路径中的 lock_sock（） 之后重新检查。监听套接字会继续接受来自任何来源的数据包。在丢弃验证失败的源之前，以从接收到的数据包中寻址的 RST 进行回复。这可为绑定的非监听套接字和同时关闭的套接字保留现有重置行为，而不将重置定向至已连接套接字的存储对等机。（CVE-2026-99122）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - vsock/vmci:接続済みソケットのパケットソースを検証します vmci_transport_recv_stream_cb() は、最初に完全なソースと宛先のタプルによってソケットを検索し、次にバインドされたテーブル内の宛先のみでソケットを検索します。フォールバックが、パケットが保存されたピアからのものかどうかをチェックせずに非リッスンソケットを選択する可能性があります。これは、2 つの VMCI コンテキストで再現されました。TCP_SYN_SENTソケットに保存されていないコンテキストからの RST により、宛先限定の検索で選択された後に、そのソケットがリセットされます。VMCI は、ソケットがユーザーコンテキストによって所有されていない場合、下半分のコンテキストで通知パケットを処理したり、パケットを作業キューへ延期したりする可能性があります。下半分のパスでソケットロックをかけた後に vsock_check_source() を使用し、workqueue パスで lock_sock() した後に再チェックします。リスニングソケットは、どのソースからのパケットも受け入れ続けます。検証に失敗したソースをドロップする前に、受信したパケットからアドレス指定された RST で返信します。これにより、接続済みソケットの保存済みピアにリセットをダイレクトせずに、バインドされている非リッスンソケットおよび同時に閉じたソケットに対して既存のリセット動作が維持されます。(CVE-2026-99122)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1794643812 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz     capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every     band if 6 GHz is supported, so add the size to scan_ies_len. Otherwise, building probe request elements     can fail, triggering the WARN_ON in __ieee80211_start_scan(). (CVE-2026-98328)

  - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix issue in verifying     allow_ptr_leaks After we converted the capabilities of our networking-bpf program from cap_sys_admin to     cap_net_admin+cap_bpf, our networking-bpf program failed to start. Because it failed the bpf verifier, and     the error log is R3 pointer comparison prohibited. A simple reproducer as follows, SEC(cls-ingress)     int ingress(struct __sk_buff *skb) { struct iphdr *iph = (void *)(long)skb->data + sizeof(struct ethhdr);
    if ((long)(iph + 1) > (long)skb->data_end) return TC_ACT_STOLEN; return TC_ACT_OK; } Per discussion with     Yonghong and Alexei [1], comparison of two packet pointers is not a pointer leak. This patch fixes it. Our     local kernel is 6.1.y and we expect this fix to be backported to 6.1.y, so stable is CCed. [1].
    https://lore.kernel.org/bpf/CAADnVQ+Nmspr7Si+pxWn8zkE7hX-7s93ugwC+94aXSy4uQ9vBg@mail.gmail.com/     (CVE-2023-54181)

  - In the Linux kernel, the following vulnerability has been resolved: driver core: Avoid warning when     removing a device while its supplier is unbinding During driver removal, the following warning can appear:
    WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 __device_links_no_driver+0xcc/0xfc ... Call trace:
    __device_links_no_driver+0xcc/0xfc (P) device_links_driver_cleanup+0xa8/0xf0     device_release_driver_internal+0x208/0x23c device_links_unbind_consumers+0xe0/0x108     device_release_driver_internal+0xec/0x23c device_links_unbind_consumers+0xe0/0x108     device_release_driver_internal+0xec/0x23c device_links_unbind_consumers+0xe0/0x108     device_release_driver_internal+0xec/0x23c driver_detach+0xa0/0x12c bus_remove_driver+0x6c/0xbc     driver_unregister+0x30/0x60 pci_unregister_driver+0x20/0x9c lan966x_pci_driver_exit+0x18/0xa90     [lan966x_pci] This warning is triggered when a consumer is removed because the links status of its     supplier is not DL_DEV_DRIVER_BOUND and the link flag DL_FLAG_SYNC_STATE_ONLY is not set. The topology in     terms of consumers/suppliers used was the following (consumer ---> supplier): i2c -----------> OIC ---->     PCI device | ^ | | +---> pinctrl ---+ When the PCI device is removed, the OIC (interrupt controller) has     to be removed. In order to remove the OIC, pinctrl and i2c need to be removed and to remove pinctrl, i2c     need to be removed. The removal order is: 1) i2c 2) pinctrl 3) OIC 4) PCI device In details, the removal     sequence is the following (with 0000:01:00.0 the PCI device): driver_detach: call     device_release_driver_internal(0000:01:00.0)... device_links_busy(0000:01:00.0): links->status =     DL_DEV_UNBINDING device_links_unbind_consumers(0000:01:00.0): 0000:01:00.0--oic link->status =     DL_STATE_SUPPLIER_UNBIND call device_release_driver_internal(oic)... device_links_busy(oic): links->status     = DL_DEV_UNBINDING device_links_unbind_consumers(oic): oic--pinctrl link->status =     DL_STATE_SUPPLIER_UNBIND call device_release_driver_internal(pinctrl)... device_links_busy(pinctrl):
    links->status = DL_DEV_UNBINDING device_links_unbind_consumers(pinctrl): pinctrl--i2c link->status =     DL_STATE_SUPPLIER_UNBIND call device_release_driver_internal(i2c)... device_links_busy(i2c): links->status     = DL_DEV_UNBINDING __device_links_no_driver(i2c)... pinctrl--i2c link->status is DL_STATE_SUPPLIER_UNBIND     oic--i2c link->status is DL_STATE_ACTIVE oic--i2c link->supplier->links.status is DL_DEV_UNBINDING The     warning is triggered by the i2c removal because the OIC (supplier) links status is not     DL_DEV_DRIVER_BOUND. Its links status is indeed set to DL_DEV_UNBINDING. It is perfectly legit to have the     links status set to DL_DEV_UNBINDING in that case. Indeed we had started to unbind the OIC which triggered     the consumer unbinding and didn't finish yet when the i2c is unbound. Avoid the warning when the supplier     links status is set to DL_DEV_UNBINDING and thus support this removal sequence without any warnings.
    (CVE-2026-97479)

  - In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB     altmode array index The UCSI displayport driver indexes the connector's port altmode array with the     GET_CURRENT_CAM response after checking it is not 0xff. The port altmode array is UCSI_MAX_ALTMODES     elements long. If the PPM returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and not     equal to 0xff, the kernel may crash with an array index OOB error. Update the UCSI displayport driver to     verify the current cam is less than UCSI_MAX_ALTMODES before accessing the port altmode array.
    (CVE-2026-90025)

  - In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: fix layout segment leak on     the pnfs_layout_process() forget path When the server returns a new layout stateid while a valid one is     still held, pnfs_layout_process() calls pnfs_mark_matching_lsegs_return() on the on-stack free_me list and     jumps to out_forget. Segments whose reference count drops to zero are unlinked from lo->plh_segs and moved     to free_me by mark_lseg_invalid(); for an idle cached segment the layout header holds the only reference,     so this happens on the first decrement. out_forget never drains free_me -- only the success path calls     pnfs_free_lseg_list(). Commit 814b84971388 (pNFS/NFSv4: Fix a layout segment leak in     pnfs_layout_process()) added the drain; commit 08bd8dbe8882 (pNFS/NFSv4: Try to return invalid layout in     pnfs_layout_process()) removed it while switching the destination to lo->plh_return_segs, which is     drained elsewhere. Commit fb700ef02676 (NFSv4.1: Simplify layout return in pnfs_layout_process())     switched the destination back to free_me without restoring the drain. Restore the pnfs_free_lseg_list()     call. (CVE-2026-89710)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - vsock/vmci: validate packet source for connected sockets vmci_transport_recv_stream_cb() looks up sockets     first by the full source and destination tuple, then by destination only in the bound table. The fallback     can select a non-listening socket without checking whether the packet came from its stored peer. This was     reproduced with two VMCI contexts. A RST from the context not stored in a TCP_SYN_SENT socket reset that     socket after it was selected by the destination-only lookup. VMCI can process notification packets in     bottom-half context when the socket is not owned by user context, or defer packets to a workqueue. Use     vsock_check_source() after taking the socket lock in the bottom-half path, and recheck after lock_sock()     in the workqueue path. Listening sockets continue to accept packets from any source. Reply with a RST     addressed from the received packet before dropping a source that fails validation. This preserves the     existing reset behavior for bound non-listening and concurrently closed sockets without directing the     reset to a connected socket's stored peer. (CVE-2026-99122)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
373284	Linux Distros 未修補弱點：CVE-2026-99122	Nessus	Misc.	2026/10/28	2026/11/14	high
373284	Linux Distros 未修补的漏洞：CVE-2026-99122	Nessus	Misc.	2026/10/28	2026/11/14	high
373284	Linux Distros のパッチ未適用の脆弱性: CVE-2026-99122	Nessus	Misc.	2026/10/28	2026/11/14	high
381298	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1794643812)	Nessus	Alma Linux Local Security Checks	2026/11/14	2026/11/14	high
373284	Linux Distros Unpatched Vulnerability : CVE-2026-99122	Nessus	Misc.	2026/10/28	2026/11/14	high

偵測

搜尋 Plugin

high

high

high

high

high