According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath(CVE-2026-43112)

    lib/crypto: chacha: Zeroize permuted_state before it leaves scope(CVE-2026-43336)

    MIPS: Work around LLVM bug when gp is used as global register variable(CVE-2026-46250)

    bridge: br_nd_send: validate ND option lengths(CVE-2026-31752)

    iommu/vt-d: Clear Present bit before tearing down PASID entry(CVE-2026-45894)

    xfs: remove xfs_attr_leaf_hasname(CVE-2026-43153)

    smb: client: reject userspace cifs.spnego descriptions(CVE-2026-46243)

    usb: ulpi: fix double free in ulpi_register_interface() error path(CVE-2026-31759)

    crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed(CVE-2026-31698)

    RDMA/hns: Fix WQ_MEM_RECLAIM warning(CVE-2026-46265)

    KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1(CVE-2026-46076)

    netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation(CVE-2026-45859)

    RDMA/umem: Fix double dma_buf_unpin in failure path(CVE-2026-43128)

    mm/page_alloc: change all pageblocks migrate type on coalescing(CVE-2025-71134)

    slip: reject VJ receive packets on instances with no rstate array(CVE-2026-45842)

    net/tcp-md5: Fix MAC comparison to be constant-time(CVE-2026-43383)

    scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()(CVE-2026-45872)

    netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()(CVE-2026-43450)

    tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()(CVE-2026-46196)

    tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure(CVE-2026-45941)

    zram: do not forget to endio for partial discard requests(CVE-2026-46089)

    KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0(CVE-2026-46082)

    vsock: fix buffer size clamping order(CVE-2026-46234)

    ipv4: icmp: validate reply type before using icmp_pointers(CVE-2026-46037)

    powerpc/smp: Add check for kcalloc() failure in parse_thread_groups()(CVE-2026-43148)

    ipmi: Check event message buffer response for bad data(CVE-2026-46128)

    netfilter: arp_tables: fix IEEE1394 ARP payload parsing(CVE-2026-45844)

    ext4: move ext4_percpu_param_init() before ext4_mb_init()(CVE-2026-43288)

    usb: typec: ucsi: validate connector number in ucsi_notify_common()(CVE-2026-31729)

    dm: remove fake timeout to avoid leak request(CVE-2026-43314)

    nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free(CVE-2026-46304)

    xfrm: Wait for RCU readers during policy netns exit(CVE-2026-43091)

    netfilter: nf_conntrack_h323: fix OOB read in decode_choice()(CVE-2026-43233)

    scsi: core: Fix refcount leak for tagset_refcnt(CVE-2026-23296)

    md/raid10: fix deadlock with check operation and nowait requests(CVE-2026-46050)

    netfilter: nf_conncount: increase the connection clean up limit to 64(CVE-2026-45860)

    crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed(CVE-2026-31697)

    net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ(CVE-2026-43465)

    fanotify: fix false positive on permission events(CVE-2026-46150)

    ipv6: icmp: clear skb2-cb[] in ip6_err_gen_icmpv6_unreach()(CVE-2026-43038)

    APEI/GHES: ensure that won't go past CPER allocated record(CVE-2026-43277)

    openvswitch: cap upcall PID array size and pre-size vport replies(CVE-2026-45840)

    AppArmor: Allow apparmor to handle unaligned dfa tables(CVE-2026-46254)

    tun: free page on short-frame rejection in tun_xdp_one()(CVE-2026-46321)

    smb: client: validate dacloffset before building DACL pointers(CVE-2026-46195)

    bpf: sockmap: Fix use-after-free of sk-sk_socket in sk_psock_verdict_data_ready().(CVE-2026-43016)

    net: af_key: zero aligned sockaddr tail in PF_KEY exports(CVE-2026-43088)

    iommu/amd: move wait_on_sem() out of spinlock(CVE-2026-43253)

    fs/buffer: add alert in try_to_free_buffers() for folios without buffers(CVE-2025-71295)

    ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1(CVE-2026-45858)

    fat: avoid parent link count underflow in rmdir(CVE-2026-45915)

    mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()(CVE-2026-46190)

    tcp: call sk_data_ready() after listener migration(CVE-2026-46015)

    sched/rt: Skip currently executing CPU in rto_next_cpu()(CVE-2026-45919)

    xfrm6: fix uninitialized saddr in xfrm6_get_saddr()(CVE-2026-43139)

    rtmutex: Use waiter::task instead of current in remove_waiter()(CVE-2026-43499)

    bpf: Fix bpf_xdp_store_bytes proto for read-only arg(CVE-2026-45886)

    ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O(CVE-2026-45985)

    netfilter: xt_tcpmss: check remaining length before reading optlen(CVE-2026-43190)

    crypto: pcrypt - Fix handling of MAY_BACKLOG requests(CVE-2026-43493)

    ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()(CVE-2026-43186)

    media: saa7164: add ioremap return checks and cleanups(CVE-2026-46235)

    l2tp: Drop large packets with UDP encap(CVE-2026-43080)

    md/raid5: validate payload size before accessing journal metadata(CVE-2026-46070)

    smb: client: fix in-place encryption corruption in SMB2_write()(CVE-2026-43362)

    drm/display/dp_mst: Add protection against 0 vcpi(CVE-2025-71305)

    x86-64: rename misleadingly named '__copy_user_nocache()' function(CVE-2026-43073)

    serial: 8250: Fix TX deadlock when using DMA(CVE-2026-43061)

    md raid: fix hang when stopping arrays with metadata through dm-raid(CVE-2026-43309)

    iommu/vt-d: Clear Present bit before tearing down context entry(CVE-2026-45944)

    netfilter: nft_ct: drop pending enqueued packets on removal(CVE-2026-43060)

    xfrm: always flush state and policy upon NETDEV_UNREGISTER event(CVE-2026-43167)

    KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT(CVE-2026-46032)

    nfsd: never defer requests during idmap lookup(CVE-2026-45983)

    exit: prevent preemption of oopsing TASK_DEAD task(CVE-2026-46173)

    md/raid10: fix divide-by-zero in setup_geo() with zero far_copies(CVE-2026-46161)

    APEI/GHES: ARM processor Error: don't go past allocated memory(CVE-2026-43201)

    netfilter: nf_conntrack_helper: pass helper to expect cleanup(CVE-2026-43027)

    net: consume xmit errors of GSO frames(CVE-2026-43194)

    net/mlx5: lag: Check for LAG device before creating debugfs(CVE-2026-43013)

    net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-     leak(CVE-2026-43035)

    ipmi: Add limits to event and receive message requests(CVE-2026-46177)

    nouveau/dpcd: return EBUSY for aux xfer if the device is asleep(CVE-2026-43381)

    perf: sched: Fix perf crash with new is_user_task() helper(CVE-2026-23159)

    netfilter: x_tables: guard option walkers against 1-byte tail reads(CVE-2026-43452)

    mmc: core: Avoid bitfield RMW for claim/retune flags(CVE-2026-43484)

    unshare: fix unshare_fs() handling(CVE-2026-43472)

    net: strparser: fix skb_head leak in strp_abort_strp()(CVE-2026-46102)

    vsock/virtio: fix accept queue count leak on transport mismatch(CVE-2026-46214)

    scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()(CVE-2026-46149)

    scsi: sd: fix missing put_disk() when device_add(disk_dev) fails(CVE-2026-45997)

    crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption(CVE-2026-43033)

    smb: client: require a full NFS mode SID before reading mode bits(CVE-2026-43350)

    xfrm_user: fix info leak in build_mapping()(CVE-2026-43089)

    ext4: drop extent cache when splitting extent fails(CVE-2026-45899)

    net/mlx5: Fix deadlock between devlink lock and esw-wq(CVE-2026-43468)

    smb: client: validate the whole DACL before rewriting it in cifsacl(CVE-2026-31709)

    ip6_tunnel: clear skb2-cb[] in ip4ip6_err()(CVE-2026-43037)

    net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback(CVE-2026-43057)

    ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()(CVE-2026-43101)

    netfilter: ctnetlink: ignore explicit helper on new expectations(CVE-2026-43025)

    net: Drop the lock in skb_may_tx_timestamp()(CVE-2026-43216)

    dm mirror: fix integer overflow in create_dirty_log()(CVE-2026-46023)

    usb: image: mdc800: kill download URB on timeout(CVE-2026-43425)

    netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path(CVE-2026-43451)

    usb: class: cdc-wdm: fix reordering issue in read code path(CVE-2026-43427)

    net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()(CVE-2026-31700)

    smb/client: fix out-of-bounds read in symlink_data()(CVE-2026-46185)

    xsk: validate MTU against usable frame size on bind(CVE-2026-43092)

    fuse: reject oversized dirents in page cache(CVE-2026-31694)

    net: ioam6: fix OOB and missing lock(CVE-2026-43083)

    usb: usbtmc: Flush anchored URBs in usbtmc_release(CVE-2026-31758)

    usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl(CVE-2026-46167)

    ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths(CVE-2026-43066)

    ipv6: prevent possible UaF in addrconf_permanent_addr()(CVE-2026-43339)

    net: hns3: fix double free issue for tx spare buffer(CVE-2026-45891)

    8021q: delete cleared egress QoS mappings(CVE-2026-46153)

    cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path(CVE-2026-43328)

    apparmor: fix NULL sock in aa_sock_file_perm(CVE-2026-45848)

    net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo(CVE-2026-46132)

    usb: usblp: fix heap leak in IEEE 1284 device ID via short response(CVE-2026-46151)

    xfs: delete attr leaf freemap entries when empty(CVE-2026-43187)

    PCI: Fix pci_slot_trylock() error handling(CVE-2026-43211)

    pstore/ram: fix buffer overflow in persistent_ram_save_old()(CVE-2026-46253)

    ima: verify the previous kernel's IMA buffer lies in addressable RAM(CVE-2026-43129)

    net: bridge: use a stable FDB dst snapshot in RCU readers(CVE-2026-46086)

    iommu/vt-d: Flush cache for PASID table before using it(CVE-2026-45862)

    KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding(CVE-2026-43315)

    xfrm: ah: account for ESN high bits in async callbacks(CVE-2026-46193)

    ext4: don't cache extent during splitting extent(CVE-2026-45912)

    io_uring/kbuf: check if target buffer list is still legacy on recycle(CVE-2026-43366)

    ipvs: fix NULL deref in ip_vs_add_service error path(CVE-2026-43086)

    md/raid5: fix soft lockup in retry_aligned_read()(CVE-2026-46051)

    ipmi:si: Return state to normal if message allocation fails(CVE-2026-46108)

    isofs: validate Rock Ridge CE continuation extent against volume size(CVE-2026-46303)

    crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl(CVE-2026-43078)

    xfrm: account XFRMA_IF_ID in aevent size calculation(CVE-2026-43107)

    ext4: fix memory leak in ext4_ext_shift_extents()(CVE-2026-45948)

    xsk: tighten UMEM headroom validation to account for tailroom and min frame(CVE-2026-43093)

    drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()(CVE-2026-46209)

    eventfs: Hold eventfs_mutex and SRCU when remount walks events(CVE-2026-46106)

    udf: fix partition descriptor append bookkeeping(CVE-2026-45991)

    md/bitmap: fix GPF in write_page caused by resize race(CVE-2026-43163)

    xfs: fix freemap adjustments when adding xattrs to leaf blocks(CVE-2026-43158)

    procfs: fix missing RCU protection when reading real_parent in do_task_stat()(CVE-2026-46259)

    KVM: SVM: Add missing save/restore handling of LBR MSRs(CVE-2026-46014)

    apparmor: fix invalid deref of rawdata when export_binary is unset(CVE-2026-45965)

    KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN(CVE-2026-46059)

    media: pvrusb2: fix URB leak in pvr2_send_request_ex(CVE-2026-43223)

    xprtrdma: Decrement re_receiving on the early exit paths(CVE-2026-43469)

    tcp: fix potential race in tcp_v6_syn_recv_sock()(CVE-2026-43198)

    x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache(CVE-2026-46174)

    netfilter: x_tables: ensure names are nul-terminated(CVE-2026-43028)

    dlm: validate length in dlm_search_rsb_tree(CVE-2026-43125)

    ipvs: do not keep dest_dst if dev is going down(CVE-2026-45917)

    ipv4: icmp: fix null-ptr-deref in icmp_build_probe()(CVE-2026-43099)

    eventpoll: fix ep_remove struct eventpoll / struct file UAF(CVE-2026-46242)

    RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()(CVE-2026-46181)

    drm/nouveau: fix u32 overflow in pushbuf reloc bounds check(CVE-2026-46006)

    ata: libata-scsi: avoid Non-NCQ command starvation(CVE-2026-45855)

    net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-43441)

    drm/amd/display: Fix dc_link NULL handling in HPD init(CVE-2026-46245)

    fbcon: Avoid OOB font access if console rotation fails(CVE-2026-46191)

    net: remove WARN_ON_ONCE when accessing forward path array(CVE-2026-45847)

    xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path(CVE-2026-45905)

    xfs: fix a resource leak in xfs_alloc_buftarg()(CVE-2026-46005)

    net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery(CVE-2026-43466)

    HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()(CVE-2026-43136)

    mm/page_alloc: clear page-private in free_pages_prepare()(CVE-2026-43303)

    crypto: authencesn - reject short ahash digests during instance creation(CVE-2026-46033)

    eventpoll: defer struct eventpoll free to RCU grace period(CVE-2026-43074)

    cpuidle: Skip governor when only one idle state is available(CVE-2026-45968)

    netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()(CVE-2026-43453)

    crypto: algif_aead - Fix minimum RX size check for decryption(CVE-2026-43077)

    cgroup: fix race between task migration and iteration(CVE-2026-43439)

    thermal: core: Fix thermal zone governor cleanup issues(CVE-2026-46021)

    scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT(CVE-2026-43475)

    quota: fix livelock between quotactl and freeze_super(CVE-2026-45895)

    net/ipv6: ioam6: prevent schema length wraparound in trace fill(CVE-2026-43341)

    KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2(CVE-2026-45987)

    dm-thin: fix metadata refcount underflow(CVE-2026-46107)

    flow_dissector: do not dissect PPPoE PFC frames(CVE-2026-46306)

    RDMA/hns: Fix unlocked call to hns_roce_qp_remove()(CVE-2026-46112)

    netfilter: ctnetlink: ensure safe access to master conntrack(CVE-2026-43116)

    ext4: fix e4b bitmap inconsistency reports(CVE-2026-45942)

    smb: client: use kzalloc to zero-initialize security descriptor buffer(CVE-2026-46139)

    EFI/CPER: don't go past the ARM processor CPER record buffer(CVE-2026-43266)

    nvmet-tcp: fix race between ICReq handling and queue teardown(CVE-2026-46135)

    netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry(CVE-2026-43114)

    (CVE-2026-46320)

    ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()(CVE-2026-46046)

    SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path(CVE-2026-45964)

    ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()(CVE-2026-46172)

    dm: fix a buffer overflow in ioctl processing(CVE-2026-46294)

    ext4: drop extent cache after doing PARTIAL_VALID1 zeroout(CVE-2026-45892)

    SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths(CVE-2026-45870)

    sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL(CVE-2026-46227)

    x86/kexec: add a sanity check on previous kernel's ima kexec buffer(CVE-2026-43240)

    Revert 'PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV'(CVE-2026-43147)

    netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets(CVE-2026-45873)

    xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete(CVE-2026-46116)

    spi: fix resource leaks on device setup failure(CVE-2026-46083)

    mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()(CVE-2026-43281)

    fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info(CVE-2026-46065)

    inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails(CVE-2026-46040)

    smb/client: fix out-of-bounds read in smb2_compound_op()(CVE-2026-46155)

    vxlan: validate ND option lengths in vxlan_na_create(CVE-2026-31738)

    drm: Account property blob allocations to memcg(CVE-2026-43287)

    crypto: algif_aead - snapshot IV for async AEAD requests(CVE-2026-46028)

    netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator(CVE-2026-43085)

    netfilter: nf_tables: reject immediate NF_QUEUE verdict(CVE-2026-43024)

    scsi: csiostor: Fix dereference of null pointer rn(CVE-2026-45857)

    bonding: alb: fix UAF in rlb_arp_recv during bond up/down(CVE-2026-45970)

    usb: xhci: Fix memory leak in xhci_disable_slot()(CVE-2026-43432)

    bpf: Fix tcx/netkit detach permissions when prog fd isn't given(CVE-2026-45932)

    netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO(CVE-2026-45841)

    ext4: fix dirtyclusters double decrement on fs shutdown(CVE-2026-45920)

    slip: bound decode() reads against the compressed packet length(CVE-2026-45843)

    net: use skb_header_pointer() for TCPv4 GSO frag_off check(CVE-2026-43036)

    net: bridge: mcast: always update mdb_n_entries for vlan contexts(CVE-2026-45913)

    net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-     leak(CVE-2026-43040)

    bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()(CVE-2026-45839)

    iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode(CVE-2026-43130)

    PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails(CVE-2026-45880)

    bpf: fix end-of-list detection in cgroup_storage_get_next_key()(CVE-2026-45838)

    ipvs: skip ipv6 extension headers for csum checks(CVE-2026-45850)

    netfilter: reject zero shift in nft_bitwise(CVE-2026-46101)

    RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send(CVE-2026-45856)

    sched/fair: Fix zero_vruntime tracking fix(CVE-2026-43323)

    crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed(CVE-2026-31699)

    netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent(CVE-2026-43026)

    net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ(CVE-2026-43464)

    isofs: validate block number from NFS file handle in isofs_export_iget(CVE-2026-46124)

    ipmi:ssif: Clean up kthread on errors(CVE-2026-46044)

    erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()(CVE-2026-45999)

    ipv6: rpl: reserve mac_len headroom when recompressed SRH grows(CVE-2026-43501)

    erofs: fix inline data read failure for ztailpacking pclusters(CVE-2026-45943)

    erofs: fix the out-of-bounds nameoff handling for trailing dirents(CVE-2026-46078)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102041 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: ah: account for ESN high bits in async callbacks

    AH allocates its temporary auth/ICV layout differently when ESN is enabled:
    the async ahash setup appends a 4-byte seqhi slot before the ICV or     auth_data area, but the async completion callbacks still reconstruct the     temporary layout as if seqhi were absent.

    With an async AH implementation selected, that makes AH copy or compare     the wrong bytes on both the IPv4 and IPv6 paths. In UML repro on IPv4 AH     with ESN and forced async hmac(sha1), ping fails with 100% packet loss,     and the callback logs show the pre-fix drift:

      ah4 output_done: esn=1 err=0 icv_off=20 expected_off=24       ah4 input_done: esn=1 auth_off=20 expected_auth_off=24 icv_off=32 expected_icv_off=36

    Reconstruct the callback-side layout the same way the setup path built it     by skipping the ESN seqhi slot before locating the saved auth_data or ICV.
    Per RFC 4302, the ESN high-order 32 bits participate in the AH ICV     computation, so the async callbacks must account for the seqhi slot.

    Post-fix, the same IPv4 AH+ESN+forced-async-hmac(sha1) UML repro shows     the corrected offset (ah4 output_done: esn=1 err=0 icv_off=24     expected_off=24) and ping succeeds; net/ipv4/ah4.o and net/ipv6/ah6.o     build clean at W=1. IPv6 AH+ESN was not exercised at runtime, and the     change has not been tested against a real async hardware AH engine.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098996 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: ah: account for ESN high bits in async callbacks

    AH allocates its temporary auth/ICV layout differently when ESN is enabled:
    the async ahash setup appends a 4-byte seqhi slot before the ICV or     auth_data area, but the async completion callbacks still reconstruct the     temporary layout as if seqhi were absent.

    With an async AH implementation selected, that makes AH copy or compare     the wrong bytes on both the IPv4 and IPv6 paths. In UML repro on IPv4 AH     with ESN and forced async hmac(sha1), ping fails with 100% packet loss,     and the callback logs show the pre-fix drift:

      ah4 output_done: esn=1 err=0 icv_off=20 expected_off=24       ah4 input_done: esn=1 auth_off=20 expected_auth_off=24 icv_off=32 expected_icv_off=36

    Reconstruct the callback-side layout the same way the setup path built it     by skipping the ESN seqhi slot before locating the saved auth_data or ICV.
    Per RFC 4302, the ESN high-order 32 bits participate in the AH ICV     computation, so the async callbacks must account for the seqhi slot.

    Post-fix, the same IPv4 AH+ESN+forced-async-hmac(sha1) UML repro shows     the corrected offset (ah4 output_done: esn=1 err=0 icv_off=24     expected_off=24) and ping succeeds; net/ipv4/ah4.o and net/ipv6/ah6.o     build clean at W=1. IPv6 AH+ESN was not exercised at runtime, and the     change has not been tested against a real async hardware AH engine.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4665 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4665-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     July 03, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux     Version        : 6.1.176-1     CVE ID         : CVE-2023-53292 CVE-2023-53989 CVE-2023-54125 CVE-2023-54271                      CVE-2023-54322 CVE-2024-27012 CVE-2024-36922 CVE-2024-53221                      CVE-2024-56657 CVE-2025-10263 CVE-2025-21739 CVE-2025-21863                      CVE-2025-22105 CVE-2025-37864 CVE-2025-38584 CVE-2025-38627                      CVE-2025-38710 CVE-2025-39997 CVE-2025-40347 CVE-2025-68201                      CVE-2025-68315 CVE-2025-68823 CVE-2026-23066 CVE-2026-23255                      CVE-2026-23310 CVE-2026-23389 CVE-2026-23399 CVE-2026-23442                      CVE-2026-23444 CVE-2026-23468 CVE-2026-31407 CVE-2026-31449                      CVE-2026-31488 CVE-2026-31489 CVE-2026-31500 CVE-2026-31532                      CVE-2026-31576 CVE-2026-31577 CVE-2026-31578 CVE-2026-31580                      CVE-2026-31581 CVE-2026-31583 CVE-2026-31585 CVE-2026-31586                      CVE-2026-31587 CVE-2026-31588 CVE-2026-31590 CVE-2026-31594                      CVE-2026-31595 CVE-2026-31596 CVE-2026-31597 CVE-2026-31598                      CVE-2026-31599 CVE-2026-31602 CVE-2026-31603 CVE-2026-31605                      CVE-2026-31607 CVE-2026-31611 CVE-2026-31612 CVE-2026-31613                      CVE-2026-31615 CVE-2026-31616 CVE-2026-31617 CVE-2026-31618                      CVE-2026-31619 CVE-2026-31622 CVE-2026-31623 CVE-2026-31624                      CVE-2026-31625 CVE-2026-31626 CVE-2026-31627 CVE-2026-31629                      CVE-2026-31630 CVE-2026-31637 CVE-2026-31642 CVE-2026-31673                      CVE-2026-31676 CVE-2026-31681 CVE-2026-31684 CVE-2026-31685                      CVE-2026-31686 CVE-2026-31696 CVE-2026-31697 CVE-2026-31698                      CVE-2026-31699 CVE-2026-31700 CVE-2026-31701 CVE-2026-31702                      CVE-2026-31704 CVE-2026-31705 CVE-2026-31708 CVE-2026-31709                      CVE-2026-31711 CVE-2026-31712 CVE-2026-31715 CVE-2026-31716                      CVE-2026-43052 CVE-2026-43058 CVE-2026-43064 CVE-2026-43071                      CVE-2026-43072 CVE-2026-43075 CVE-2026-43076 CVE-2026-43079                      CVE-2026-43080 CVE-2026-43085 CVE-2026-43089 CVE-2026-43093                      CVE-2026-43094 CVE-2026-43098 CVE-2026-43099 CVE-2026-43103                      CVE-2026-43104 CVE-2026-43105 CVE-2026-43110 CVE-2026-43111                      CVE-2026-43112 CVE-2026-43113 CVE-2026-43114 CVE-2026-43116                      CVE-2026-43117 CVE-2026-43219 CVE-2026-43303 CVE-2026-43350                      CVE-2026-43421 CVE-2026-43492 CVE-2026-43493 CVE-2026-43494                      CVE-2026-43495 CVE-2026-43496 CVE-2026-43497 CVE-2026-43499                      CVE-2026-43501 CVE-2026-43502 CVE-2026-45834 CVE-2026-45835                      CVE-2026-45836 CVE-2026-45838 CVE-2026-45839 CVE-2026-45840                      CVE-2026-45841 CVE-2026-45842 CVE-2026-45843 CVE-2026-45844                      CVE-2026-45846 CVE-2026-45850 CVE-2026-45930 CVE-2026-45986                      CVE-2026-45987 CVE-2026-45991 CVE-2026-45994 CVE-2026-45996                      CVE-2026-45997 CVE-2026-45999 CVE-2026-46002 CVE-2026-46003                      CVE-2026-46004 CVE-2026-46005 CVE-2026-46006 CVE-2026-46009                      CVE-2026-46015 CVE-2026-46018 CVE-2026-46019 CVE-2026-46021                      CVE-2026-46022 CVE-2026-46023 CVE-2026-46024 CVE-2026-46026                      CVE-2026-46027 CVE-2026-46031 CVE-2026-46033 CVE-2026-46037                      CVE-2026-46038 CVE-2026-46040 CVE-2026-46043 CVE-2026-46044                      CVE-2026-46046 CVE-2026-46047 CVE-2026-46049 CVE-2026-46050                      CVE-2026-46051 CVE-2026-46052 CVE-2026-46053 CVE-2026-46056                      CVE-2026-46058 CVE-2026-46062 CVE-2026-46064 CVE-2026-46065                      CVE-2026-46069 CVE-2026-46070 CVE-2026-46072 CVE-2026-46075                      CVE-2026-46077 CVE-2026-46078 CVE-2026-46079 CVE-2026-46080                      CVE-2026-46082 CVE-2026-46083 CVE-2026-46086 CVE-2026-46088                      CVE-2026-46091 CVE-2026-46098 CVE-2026-46099 CVE-2026-46101                      CVE-2026-46102 CVE-2026-46103 CVE-2026-46107 CVE-2026-46108                      CVE-2026-46109 CVE-2026-46110 CVE-2026-46112 CVE-2026-46113                      CVE-2026-46116 CVE-2026-46119 CVE-2026-46120 CVE-2026-46122                      CVE-2026-46123 CVE-2026-46124 CVE-2026-46125 CVE-2026-46127                      CVE-2026-46128 CVE-2026-46129 CVE-2026-46132 CVE-2026-46133                      CVE-2026-46136 CVE-2026-46137 CVE-2026-46143 CVE-2026-46146                      CVE-2026-46149 CVE-2026-46150 CVE-2026-46151 CVE-2026-46159                      CVE-2026-46160 CVE-2026-46161 CVE-2026-46163 CVE-2026-46164                      CVE-2026-46165 CVE-2026-46167 CVE-2026-46168 CVE-2026-46169                      CVE-2026-46172 CVE-2026-46173 CVE-2026-46177 CVE-2026-46178                      CVE-2026-46179 CVE-2026-46180 CVE-2026-46184 CVE-2026-46185                      CVE-2026-46186 CVE-2026-46187 CVE-2026-46189 CVE-2026-46190                      CVE-2026-46191 CVE-2026-46193 CVE-2026-46195 CVE-2026-46196                      CVE-2026-46197 CVE-2026-46198 CVE-2026-46199 CVE-2026-46205                      CVE-2026-46206 CVE-2026-46208 CVE-2026-46209 CVE-2026-46212                      CVE-2026-46214 CVE-2026-46218 CVE-2026-46220 CVE-2026-46227                      CVE-2026-46230 CVE-2026-46231 CVE-2026-46233 CVE-2026-46234                      CVE-2026-46235 CVE-2026-46236 CVE-2026-46238 CVE-2026-46273                      CVE-2026-46275 CVE-2026-46276 CVE-2026-46280 CVE-2026-46285                      CVE-2026-46291 CVE-2026-46292 CVE-2026-46294 CVE-2026-46296                      CVE-2026-46299 CVE-2026-46301 CVE-2026-46303 CVE-2026-46304                      CVE-2026-46306 CVE-2026-46307 CVE-2026-46314 CVE-2026-46319                      CVE-2026-46320 CVE-2026-46321 CVE-2026-46322 CVE-2026-46323                      CVE-2026-46331 CVE-2026-52909 CVE-2026-52910 CVE-2026-52911                      CVE-2026-52912 CVE-2026-52913 CVE-2026-52914 CVE-2026-52915                      CVE-2026-52916 CVE-2026-52917 CVE-2026-52918 CVE-2026-52919                      CVE-2026-52920 CVE-2026-52921 CVE-2026-52922 CVE-2026-52923                      CVE-2026-52924 CVE-2026-52925 CVE-2026-52926 CVE-2026-52927                      CVE-2026-52929 CVE-2026-52930 CVE-2026-52931 CVE-2026-52933                      CVE-2026-52934 CVE-2026-52935 CVE-2026-52939 CVE-2026-52941                      CVE-2026-52942 CVE-2026-52943 CVE-2026-52946 CVE-2026-52947                      CVE-2026-52948 CVE-2026-52954 CVE-2026-52955 CVE-2026-52957                      CVE-2026-52958 CVE-2026-52962 CVE-2026-52963 CVE-2026-52967                      CVE-2026-52968 CVE-2026-52969 CVE-2026-52970 CVE-2026-52972                      CVE-2026-52974 CVE-2026-52975 CVE-2026-52977 CVE-2026-52981                      CVE-2026-52982 CVE-2026-52984 CVE-2026-52985 CVE-2026-52986                      CVE-2026-52989 CVE-2026-52992 CVE-2026-52993 CVE-2026-52995                      CVE-2026-52998 CVE-2026-52999 CVE-2026-53001 CVE-2026-53002                      CVE-2026-53003 CVE-2026-53004 CVE-2026-53006 CVE-2026-53011                      CVE-2026-53012 CVE-2026-53016 CVE-2026-53021 CVE-2026-53022                      CVE-2026-53023 CVE-2026-53033 CVE-2026-53034 CVE-2026-53035                      CVE-2026-53036 CVE-2026-53037 CVE-2026-53039 CVE-2026-53040                      CVE-2026-53041 CVE-2026-53043 CVE-2026-53045 CVE-2026-53046                      CVE-2026-53047 CVE-2026-53048 CVE-2026-53049 CVE-2026-53050                      CVE-2026-53052 CVE-2026-53056 CVE-2026-53059 CVE-2026-53060                      CVE-2026-53061 CVE-2026-53062 CVE-2026-53063 CVE-2026-53064                      CVE-2026-53065 CVE-2026-53066 CVE-2026-53068 CVE-2026-53069                      CVE-2026-53071 CVE-2026-53072 CVE-2026-53073 CVE-2026-53074                      CVE-2026-53075 CVE-2026-53077 CVE-2026-53080 CVE-2026-53082                      CVE-2026-53086 CVE-2026-53088 CVE-2026-53093 CVE-2026-53096                      CVE-2026-53111 CVE-2026-53112 CVE-2026-53128 CVE-2026-53130                      CVE-2026-53131 CVE-2026-53133 CVE-2026-53134 CVE-2026-53135                      CVE-2026-53136 CVE-2026-53137 CVE-2026-53146 CVE-2026-53147                      CVE-2026-53148 CVE-2026-53149 CVE-2026-53150 CVE-2026-53159                      CVE-2026-53160 CVE-2026-53161 CVE-2026-53168 CVE-2026-53176                      CVE-2026-53177 CVE-2026-53181 CVE-2026-53182 CVE-2026-53183                      CVE-2026-53184 CVE-2026-53186 CVE-2026-53189 CVE-2026-53194                      CVE-2026-53195 CVE-2026-53196 CVE-2026-53198 CVE-2026-53199                      CVE-2026-53207 CVE-2026-53208 CVE-2026-53209 CVE-2026-53212                      CVE-2026-53213 CVE-2026-53215 CVE-2026-53216 CVE-2026-53217                      CVE-2026-53218 CVE-2026-53219 CVE-2026-53221 CVE-2026-53223                      CVE-2026-53225 CVE-2026-53227 CVE-2026-53228 CVE-2026-53236                      CVE-2026-53238 CVE-2026-53239 CVE-2026-53242 CVE-2026-53245                      CVE-2026-53249 CVE-2026-53252 CVE-2026-53253 CVE-2026-53254                      CVE-2026-53255 CVE-2026-53256 CVE-2026-53263 CVE-2026-53264                      CVE-2026-53266 CVE-2026-53268 CVE-2026-53269 CVE-2026-53270                      CVE-2026-53273 CVE-2026-53274 CVE-2026-53275 CVE-2026-53279                      CVE-2026-53287 CVE-2026-53289 CVE-2026-53291 CVE-2026-53294                      CVE-2026-53295 CVE-2026-53296 CVE-2026-53303 CVE-2026-53304                      CVE-2026-53306 CVE-2026-53309 CVE-2026-53314 CVE-2026-53320                      CVE-2026-53329 CVE-2026-53331 CVE-2026-53337 CVE-2026-53339                      CVE-2026-53343 CVE-2026-53349 CVE-2026-53350 CVE-2026-53352                      CVE-2026-53354 CVE-2026-53355 CVE-2026-53356 CVE-2026-53357     Debian Bug     : 1130365 1119093

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For Debian 12 bookworm, these problems have been fixed in version     6.1.176-1.  This version additionally includes many more bug fixes     from stable updates 6.1.175 and 6.1.176.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
339249	EulerOS Virtualization 2.13.0 : kernel (EulerOS-SA-2026-3216)	Nessus	Huawei Local Security Checks	2026/8/25	2026/10/23	high
341024	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:3790-1)	Nessus	SuSE Local Security Checks	2026/8/27	2026/9/29	high
343617	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-3270)	Nessus	Huawei Local Security Checks	2026/9/8	2026/11/3	high
346773	EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-3807)	Nessus	Huawei Local Security Checks	2026/9/17	2026/9/18	high
377235	EulerOS Virtualization 2.15.0 : kernel (EulerOS-SA-2026-4820)	Nessus	Huawei Local Security Checks	2026/11/7	2026/11/9	high
323389	Photon OS 5.0: Linux PHSA-2026-5.0-0904	Nessus	PhotonOS Local Security Checks	2026/6/28	2026/10/14	high
338563	Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102041)	Nessus	Unity Linux Local Security Checks	2026/8/21	2026/8/21	medium
340563	Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098996)	Nessus	Unity Linux Local Security Checks	2026/8/26	2026/8/28	medium
348006	EulerOS Virtualization 2.11.1 : kernel (EulerOS-SA-2026-3424)	Nessus	Huawei Local Security Checks	2026/9/18	2026/10/22	critical
325059	Debian dla-4665 : affs-modules-6.1.0-48-4kc-malta-di - security update	Nessus	Debian Local Security Checks	2026/7/3	2026/9/23	high
332791	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-2971)	Nessus	Huawei Local Security Checks	2026/8/6	2026/10/27	high
335101	SUSE SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:3595-1)	Nessus	SuSE Local Security Checks	2026/8/13	2026/9/29	high
343747	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-3345)	Nessus	Huawei Local Security Checks	2026/9/8	2026/11/3	high
347286	EulerOS Virtualization 2.12.1 : kernel (EulerOS-SA-2026-3590)	Nessus	Huawei Local Security Checks	2026/9/18	2026/11/3	high
365377	Ubuntu 20.04 LTS : Linux kernel (Oracle) vulnerabilities (USN-8879-1)	Nessus	Ubuntu Local Security Checks	2026/10/13	2026/11/13	high
329326	Photon OS 5.0: Linux PHSA-2026-5.0-0926	Nessus	PhotonOS Local Security Checks	2026/7/24	2026/11/14	high

偵測

搜尋 Plugin

high

high

high

high

high

high

medium

medium

critical

high

high

high

high

high

high

high