The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1768663754 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: ice: set tx_tstamps when creating new     Tx rings via ethtool When the user changes the number of queues via ethtool, the driver allocates new     rings. This allocation did not initialize tx_tstamps. This results in the tx_tstamps field being zero (due     to kcalloc allocation), and would result in a NULL pointer dereference when attempting a transmit     timestamp on the new ring. (CVE-2022-50710)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix use-after-free in     ath9k_hif_usb_disconnect() This patch fixes a use-after-free in ath9k that occurs in     ath9k_hif_usb_disconnect() when ath9k_destroy_wmi() is trying to access 'drv_priv' that has already been     freed by ieee80211_free_hw(), called by ath9k_htc_hw_deinit(). The patch moves ath9k_destroy_wmi() before     ieee80211_free_hw(). Note that urbs from the driver should be killed before freeing 'wmi' with     ath9k_destroy_wmi() as their callbacks will access 'wmi'. Found by a modified version of syzkaller.
    ================================================================== BUG: KASAN: use-after-free in     ath9k_destroy_wmi+0x38/0x40 Read of size 8 at addr ffff8881069132a0 by task kworker/0:1/7 CPU: 0 PID: 7     Comm: kworker/0:1 Tainted: G O 5.14.0+ #131 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS     rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace:
    dump_stack_lvl+0x8e/0xd1 print_address_description.constprop.0.cold+0x93/0x334 ?     ath9k_destroy_wmi+0x38/0x40 ? ath9k_destroy_wmi+0x38/0x40 kasan_report.cold+0x83/0xdf ?     ath9k_destroy_wmi+0x38/0x40 ath9k_destroy_wmi+0x38/0x40 ath9k_hif_usb_disconnect+0x329/0x3f0 ?     ath9k_hif_usb_suspend+0x120/0x120 ? usb_disable_interface+0xfc/0x180 usb_unbind_interface+0x19b/0x7e0 ?     usb_autoresume_device+0x50/0x50 device_release_driver_internal+0x44d/0x520 bus_remove_device+0x2e5/0x5a0     device_del+0x5b2/0xe30 ? __device_link_del+0x370/0x370 ? usb_remove_ep_devs+0x43/0x80 ?     remove_intf_ep_devs+0x112/0x1a0 usb_disable_device+0x1e3/0x5a0 usb_disconnect+0x267/0x870     hub_event+0x168d/0x3950 ? rcu_read_lock_sched_held+0xa1/0xd0 ? hub_port_debounce+0x2e0/0x2e0 ?     check_irq_usage+0x860/0xf20 ? drain_workqueue+0x281/0x360 ? lock_release+0x640/0x640 ?     rcu_read_lock_sched_held+0xa1/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ?     lockdep_hardirqs_on_prepare+0x273/0x3e0 process_one_work+0x92b/0x1460 ? pwq_dec_nr_in_flight+0x330/0x330 ?     rwlock_bug.part.0+0x90/0x90 worker_thread+0x95/0xe00 ? __kthread_parkme+0x115/0x1e0 ?     process_one_work+0x1460/0x1460 kthread+0x3a1/0x480 ? set_kthread_struct+0x120/0x120     ret_from_fork+0x1f/0x30 The buggy address belongs to the page: page:ffffea00041a44c0 refcount:0 mapcount:0     mapping:0000000000000000 index:0x0 pfn:0x106913 flags: 0x200000000000000(node=0|zone=2) raw:
    0200000000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000     00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the     page as freed page last allocated via order 3, migratetype Unmovable, gfp_mask     0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), pid 7, ts 38347963444, free_ts 41399957635     prep_new_page+0x1aa/0x240 get_page_from_freelist+0x159a/0x27c0 __alloc_pages+0x2da/0x6a0     alloc_pages+0xec/0x1e0 kmalloc_order+0x39/0xf0 kmalloc_order_trace+0x19/0x120 __kmalloc+0x308/0x390     wiphy_new_nm+0x6f5/0x1dd0 ieee80211_alloc_hw_nm+0x36d/0x2230 ath9k_htc_probe_device+0x9d/0x1e10     ath9k_htc_hw_init+0x34/0x50 ath9k_hif_usb_firmware_cb+0x25f/0x4e0 request_firmware_work_func+0x131/0x240     process_one_work+0x92b/0x1460 worker_thread+0x95/0xe00 kthread+0x3a1/0x480 page last free stack trace:
    free_pcp_prepare+0x3d3/0x7f0 free_unref_page+0x1e/0x3d0 device_release+0xa4/0x240 kobject_put+0x186/0x4c0     put_device+0x20/0x30 ath9k_htc_disconnect_device+0x1cf/0x2c0 ath9k_htc_hw_deinit+0x26/0x30     ath9k_hif_usb_disconnect+0x2d9/0x3f0 usb_unbind_interface+0x19b/0x7e0     device_release_driver_internal+0x44d/0x520 bus_remove_device+0x2e5/0x5a0 device_del+0x5b2/0xe30     usb_disable_device+0x1e3/0x5a0 usb_disconnect+0x267/0x870 hub_event+0x168d/0x3950     process_one_work+0x92b/0x1460 Memory state around the buggy address: ffff888106913180: ff ff ff ff ff ff     ff ff ff ff ff ff ff ff ff ff ffff888106913200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff888
    ---truncated--- (CVE-2022-50881)

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed     in nf_ct_find_expectation Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp     from the hash table. However, in some scenario, we expect the exp not to be removed when the created ct     will not be confirmed, like in OVS and TC conntrack in the following patches. This patch allows exp not to     be removed by setting IPS_CONFIRMED in the status of the tmpl. (CVE-2023-52927)

  - In the Linux kernel, the following vulnerability has been resolved: sched/fair: Don't balance task to its     current running CPU We've run into the case that the balancer tries to balance a migration disabled task     and trigger the warning in set_task_cpu() like below: ------------[ cut here ]------------ WARNING: CPU: 7     PID: 0 at kernel/sched/core.c:3115 set_task_cpu+0x188/0x240 Modules linked in: hclgevf xt_CHECKSUM     ipt_REJECT nf_reject_ipv4 <...snip> CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G O 6.1.0-rc4+ #1     Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V5.B221.01 12/09/2021 pstate: 604000c9     (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : set_task_cpu+0x188/0x240 lr : load_balance+0x5d0/0xc60     sp : ffff80000803bc70 x29: ffff80000803bc70 x28: ffff004089e190e8 x27: ffff004089e19040 x26:
    ffff007effcabc38 x25: 0000000000000000 x24: 0000000000000001 x23: ffff80000803be84 x22: 000000000000000c     x21: ffffb093e79e2a78 x20: 000000000000000c x19: ffff004089e19040 x18: 0000000000000000 x17:
    0000000000001fad x16: 0000000000000030 x15: 0000000000000000 x14: 0000000000000003 x13: 0000000000000000     x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000000400 x9 : ffffb093e4cee530 x8 :
    00000000fffffffe x7 : 0000000000ce168a x6 : 000000000000013e x5 : 00000000ffffffe1 x4 : 0000000000000001     x3 : 0000000000000b2a x2 : 0000000000000b2a x1 : ffffb093e6d6c510 x0 : 0000000000000001 Call trace:
    set_task_cpu+0x188/0x240 load_balance+0x5d0/0xc60 rebalance_domains+0x26c/0x380
    _nohz_idle_balance.isra.0+0x1e0/0x370 run_rebalance_domains+0x6c/0x80 __do_softirq+0x128/0x3d8
    ____do_softirq+0x18/0x24 call_on_irq_stack+0x2c/0x38 do_softirq_own_stack+0x24/0x3c
    __irq_exit_rcu+0xcc/0xf4 irq_exit_rcu+0x18/0x24 el1_interrupt+0x4c/0xe4 el1h_64_irq_handler+0x18/0x2c     el1h_64_irq+0x74/0x78 arch_cpu_idle+0x18/0x4c default_idle_call+0x58/0x194 do_idle+0x244/0x2b0     cpu_startup_entry+0x30/0x3c secondary_start_kernel+0x14c/0x190 __secondary_switched+0xb0/0xb4 ---[ end     trace 0000000000000000 ]--- Further investigation shows that the warning is superfluous, the migration     disabled task is just going to be migrated to its current running CPU. This is because that on load     balance if the dst_cpu is not allowed by the task, we'll re-select a new_dst_cpu as a candidate. If no     task can be balanced to dst_cpu we'll try to balance the task to the new_dst_cpu instead. In this case     when the migration disabled task is not on CPU it only allows to run on its current CPU, load balance will     select its current CPU as new_dst_cpu and later triggers the warning above. The new_dst_cpu is chosen from     the env->dst_grpmask. Currently it contains CPUs in sched_group_span() and if we have overlapped groups     it's possible to run into this case. This patch makes env->dst_grpmask of group_balance_mask() which     exclude any CPUs from the busiest group and solve the issue. For balancing in a domain with no overlapped     groups the behaviour keeps same as before. (CVE-2023-53215)

  - In the Linux kernel, the following vulnerability has been resolved: ubi: ensure that VID header offset +     VID header size <= alloc, size Ensure that the VID header offset + VID header size does not exceed the     allocated area to avoid slab OOB. BUG: KASAN: slab-out-of-bounds in crc32_body lib/crc32.c:111 [inline]     BUG: KASAN: slab-out-of-bounds in crc32_le_generic lib/crc32.c:179 [inline] BUG: KASAN: slab-out-of-bounds     in crc32_le_base+0x58c/0x626 lib/crc32.c:197 Read of size 4 at addr ffff88802bb36f00 by task syz-     executor136/1555 CPU: 2 PID: 1555 Comm: syz-executor136 Tainted: G W 6.0.0-1868 #1 Hardware name: Red Hat     KVM, BIOS 1.13.0-2.module+el8.3.0+7860+a7792d29 04/01/2014 Call Trace: <TASK> __dump_stack     lib/dump_stack.c:88 [inline] dump_stack_lvl+0x85/0xad lib/dump_stack.c:106 print_address_description     mm/kasan/report.c:317 [inline] print_report.cold.13+0xb6/0x6bb mm/kasan/report.c:433     kasan_report+0xa7/0x11b mm/kasan/report.c:495 crc32_body lib/crc32.c:111 [inline] crc32_le_generic     lib/crc32.c:179 [inline] crc32_le_base+0x58c/0x626 lib/crc32.c:197 ubi_io_write_vid_hdr+0x1b7/0x472     drivers/mtd/ubi/io.c:1067 create_vtbl+0x4d5/0x9c4 drivers/mtd/ubi/vtbl.c:317 create_empty_lvol     drivers/mtd/ubi/vtbl.c:500 [inline] ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812     ubi_attach+0xf34/0x1603 drivers/mtd/ubi/attach.c:1601 ubi_attach_mtd_dev+0x6f3/0x185e     drivers/mtd/ubi/build.c:965 ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043 vfs_ioctl     fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline]
    __x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline]     do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0x0 RIP:
    0033:0x7f96d5cf753d Code: RSP: 002b:00007fffd72206f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX:
    ffffffffffffffda RBX: 0000000000000000 RCX: 00007f96d5cf753d RDX: 0000000020000080 RSI: 0000000040186f40     RDI: 0000000000000003 RBP: 0000000000400cd0 R08: 0000000000000000 R09: 0000000000000000 R10:
    0000000000000000 R11: 0000000000000246 R12: 0000000000400be0 R13: 00007fffd72207e0 R14: 0000000000000000     R15: 0000000000000000 </TASK> Allocated by task 1555: kasan_save_stack+0x20/0x3d mm/kasan/common.c:38     kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:437 [inline]
    ____kasan_kmalloc mm/kasan/common.c:516 [inline] __kasan_kmalloc+0x88/0xa3 mm/kasan/common.c:525     kasan_kmalloc include/linux/kasan.h:234 [inline] __kmalloc+0x138/0x257 mm/slub.c:4429 kmalloc     include/linux/slab.h:605 [inline] ubi_alloc_vid_buf drivers/mtd/ubi/ubi.h:1093 [inline]     create_vtbl+0xcc/0x9c4 drivers/mtd/ubi/vtbl.c:295 create_empty_lvol drivers/mtd/ubi/vtbl.c:500 [inline]     ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812 ubi_attach+0xf34/0x1603     drivers/mtd/ubi/attach.c:1601 ubi_attach_mtd_dev+0x6f3/0x185e drivers/mtd/ubi/build.c:965     ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl     fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856     do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80     entry_SYSCALL_64_after_hwframe+0x63/0x0 The buggy address belongs to the object at ffff88802bb36e00 which     belongs to the cache kmalloc-256 of size 256 The buggy address is located 0 bytes to the right of 256-byte     region [ffff88802bb36e00, ffff88802bb36f00) The buggy address belongs to the physical page:
    page:00000000ea4d1263 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2bb36     head:00000000ea4d1263 order:1 compound_mapcount:0 compound_pincount:0 flags:
    0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) raw: 000fffffc0010200 ffffea000066c300     dead000000000003 ffff888100042b40 raw: 0000000000000000 00000000001 ---truncated--- (CVE-2023-53265)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:26535 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: geneve: Fix use-after-free in geneve_find_dev(). (CVE-2025-21858)

    * kernel: sctp: fix a potential overflow in sctp_ifwdtsn_skip (CVE-2023-53372)

    * kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170)

    * kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135)

    * kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158)

    * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)

    * kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CVE-2025-68800)

    * kernel: iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)

    * kernel: macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001)

    * kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration (CVE-2026-23097)

    * kernel: ALSA: aloop: Fix racy access at PCM trigger (CVE-2026-23191)

    * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216)

    * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

    * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

    * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

    * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)

    * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)

    * kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)

    * kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)

    * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)

    * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

    * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

    * kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243)

    * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)

    Bug Fix(es) and Enhancement(s):

    * NFS client hangs while returning delegations (JIRA:RHEL-112276)

    * Rhel backport of upstream commit i40e: avoid redundant VF link state update (JIRA:RHEL-141908)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
359586	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1768663754)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/2	high
321564	RHEL 8 : kernel (RHSA-2026:26535)	Nessus	Red Hat Local Security Checks	2026/6/20	2026/8/25	high

偵測

搜尋 Plugin

high

high