An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - virtio-fs: avoid double-free on failed queue setup virtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map     before calling virtio_find_vqs(). If virtio_find_vqs() fails, the error path frees both pointers and     returns an error to virtio_fs_probe(). virtio_fs_probe() then drops the last kobject reference, and     virtio_fs_ktype_release() frees fs->vqs and fs->mq_map again. This leaves dangling pointers in struct     virtio_fs and can trigger a double-free during probe failure cleanup. Set fs->vqs and fs->mq_map to NULL     immediately after kfree() in the virtio_fs_setup_vqs() error path so that the later kobject release sees     an uninitialized state and kfree(NULL) becomes harmless. This can be reproduced when a broken virtio-fs     device advertises more request queues than the transport actually provides. In that case virtio_find_vqs()     fails while setting up the extra queue, and the probe path reaches the double-free cleanup sequence.
    (CVE-2026-93827)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-93412 advisory.

    - ipv4: free inet_opt and ireq_opt after an RCU grace period (CKI Backport Bot) [RHEL-295635]     {CVE-2026-98432}
    - nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (Maurizio Lombardi) [RHEL-290719]     {CVE-2026-98725}
    - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (Iker Pedrosa) [RHEL-234297]     {CVE-2026-64303}
    - spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (Iker Pedrosa)     [RHEL-234297] {CVE-2026-64303}
    - xfrm: hold net_device reference under RCU in bundle creation (Abhishek Rawal) [RHEL-277984]     {CVE-2026-98364}
    - entry: Fix seccomp bypass after ptrace with TSYNC (Audra Mitchell) [RHEL-271399] {CVE-2026-89603}
    - smb: client: bound dirent name against end of SMB response in cifs_filldir (CKI Backport Bot)     [RHEL-278331] {CVE-2026-93787}
    - sctp: stream: fully roll back denied add-stream state (CKI Backport Bot) [RHEL-277123] {CVE-2026-52929}
    - tipc: require net admin for TIPCv2 netlink mutators (CKI Backport Bot) [RHEL-273181] {CVE-2026-74283}
    - Bluetooth: mgmt: fix UAF in pair command cancellation (CKI Backport Bot) [RHEL-254650] {CVE-2026-74510}
    - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225993] {CVE-2026-53270}
    - KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CKI Backport Bot) [RHEL-287053]     {CVE-2026-98466}
    - mptcp: pm: userspace: fix use-after-free in get_local_id (Prasenjit Mukherjee) [RHEL-236687]     {CVE-2026-68169}
    - mptcp: options: reset DSS fields in case of unexpected size (Prasenjit Mukherjee) [RHEL-250609]     {CVE-2026-80586}
    - virtio-fs: avoid double-free on failed queue setup (Miklos Szeredi) [RHEL-278131] {CVE-2026-93827}
    - scsi: target: iscsi: Reserve a terminator byte for the login payload (CKI Backport Bot) [RHEL-285602]     {CVE-2026-90011}
    - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CKI Backport Bot) [RHEL-283505]     {CVE-2026-72083}
    - packet: use consistent hard_header_len in non-ring send paths (Toke Hoiland-Jorgensen) [RHEL-244551]     {CVE-2026-74582}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2261:117 advisory.

    * kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)
      * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
      * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
      * kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)
      * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)
      * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)
      * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)
      * kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)
      * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)
      * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)
      * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)
      * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)
      * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)
      * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)
      * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)
      * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)
      * kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)
      * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)
      * kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege     Escalation Vulnerability ()

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:93412 advisory.

    * kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)
      * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
      * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
      * kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)
      * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)
      * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)
      * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)
      * kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)
      * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)
      * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)
      * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)
      * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)
      * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)
      * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)
      * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)
      * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)
      * kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)
      * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)
      * kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege     Escalation Vulnerability ()


    Bug Fix(es) and Enhancement(s):

      * kernel panic in percpu_counter_add_batch() via submit_bio_noacct() due to NULL pointer     (JIRA:RHEL-250378)
      * ipv4: ip_gre: make ipgre_header() robust (rhel-9.8.z) (JIRA:RHEL-271127)
      * ip6_gre: make ip6gre_header() robust (rhel-9.8.z) (JIRA:RHEL-271130)
      * Backport sched: The newidle balance regression series to rhel 9.8 [rhel-9.8.z] (JIRA:RHEL-288067)
      * AlmaLinux is missing support for conntrack zone filtering in dump/delete requests (9.10) [rhel-9.8.z]     (JIRA:RHEL-291352)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
375113	Photon OS 5.0: Linux PHSA-2026-5.0-91-1014	Nessus	PhotonOS Local Security Checks	2026/11/2	2026/11/2	high
349944	Linux Distros Unpatched Vulnerability : CVE-2026-93827	Nessus	Misc.	2026/9/24	2026/11/13	high
365258	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3192)	Nessus	Amazon Linux Local Security Checks	2026/10/12	2026/10/29	high
375516	Oracle Linux 9 : kernel (ELSA-2026-93412)	Nessus	Oracle Linux Local Security Checks	2026/11/3	2026/11/3	critical
376292	MiracleLinux 9 : kernel-5.14.0-687.64.1.el9_8 (AXSA:2026-2261:117)	Nessus	Miracle Linux Local Security Checks	2026/11/5	2026/11/9	critical
378137	AlmaLinux 9 : kernel (ALSA-2026:93412)	Nessus	Alma Linux Local Security Checks	2026/11/10	2026/11/10	critical

偵測

搜尋 Plugin

high

high

high

critical

critical

critical