The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500249 advisory.

    - inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge)  [Orabug: 39974835]     {CVE-2026-80590}
    - KVM: x86/mmu: Stop needlessly making MMU pages available for TDP MMU faults (David Matlack) [Orabug:
    39830590] {CVE-2026-64561}
    - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Sean Christopherson)     [Orabug: 39830590,39832946] {CVE-2026-64561}
    - KVM: x86/mmu: Rename __direct_map() to direct_map() (David Matlack) [Orabug: 39830590] {CVE-2026-64561}
    - KVM: x86/mmu: Split out TDP MMU page fault handling (David Matlack) [Orabug: 39830590] {CVE-2026-64561}
    - KVM: Rename mmu_notifier_* to mmu_invalidate_* (Chao Peng) [Orabug: 39830590] {CVE-2026-64561}
    - KVM: x86/mmu: Document the 'rules' for using host_pfn_mapping_level() (Sean Christopherson) [Orabug:
    39830590] {CVE-2026-64561}
    - KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs (Sean Christopherson) [Orabug:
    39830590] {CVE-2026-64561}
    - KVM: x86/mmu: Directly 'destroy' PTE list when recycling rmaps (Sean Christopherson) [Orabug: 39830590]     {CVE-2026-64561}
    - x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov) [Orabug: 39784615,39853775]     {CVE-2026-68480}
    - x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (Thomas Gleixner) [Orabug:
    39784615] {CVE-2026-68480}
    - x86/alternative: Support relocations in alternatives (Peter Zijlstra) [Orabug: 39784615]     {CVE-2026-68480}
    - x86/alternative: Make debug-alternative selective (Peter Zijlstra) [Orabug: 39784615] {CVE-2026-68480}
    - x86/alternatives: Add alt_instr.flags (Borislav Petkov) [Orabug: 39784615] {CVE-2026-68480}
    - x86/asm: Provide ALTERNATIVE_3 (Peter Zijlstra) [Orabug: 39784615] {CVE-2026-68480}
    - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Thomas Gleixner) [Orabug: 39807438]     {CVE-2026-64560}
    - ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (Hyeongjun An) [Orabug: 39853280]     {CVE-2026-64479}
    - crypto: qat - validate RSA CRT component lengths (Giovanni Cabiddu) [Orabug: 39785885] {CVE-2026-64304}
    - btrfs: do not trim a device which is not writeable (Qu Wenruo) [Orabug: 39843586] {CVE-2026-64593}
    - bpf: Allow LPM map access from sleepable BPF programs (Vlad Poenaru) [Orabug: 39786046] {CVE-2026-64352}
    - bpf: Reject fragmented frames in devmap (Zhao Zhang) [Orabug: 39786052] {CVE-2026-64355}
    - HID: appleir: fix UAF on pending key_up_timer in remove() (Manish Khadka) [Orabug: 39786074]     {CVE-2026-64363}
    - proc: protect ptrace_may_access() with exec_update_lock (part 1) (Jann Horn) [Orabug: 39786095]     {CVE-2026-64371}
    - HID: multitouch: fix out-of-bounds bit access on mt_io_flags (Trung Nguyen) [Orabug: 39786078]     {CVE-2026-64364}
    - proc: protect ptrace_may_access() with exec_update_lock (FD links) (Jann Horn) [Orabug: 39786112]     {CVE-2026-64375}
    - smb: client: harden POSIX SID length parsing (Zihan Xi) [Orabug: 39786128] {CVE-2026-64380}
    - smb: client: mask server-provided mode to 07777 in modefromsid (Norbert Manthey) [Orabug: 39786124]     {CVE-2026-64379}
    - smb: client: resolve SWN tcon from live registrations (Michael Bommarito) [Orabug: 39786200]     {CVE-2026-64401}
    - smb: client: Fix next buffer leak in receive_encrypted_standard() (Haoxiang Li) [Orabug: 39786131]     {CVE-2026-64381}
    - Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock (Runyu Xiao) [Orabug: 39760901]     {CVE-2026-64206}
    - netfilter: ebtables: zero chainstack array (Florian Westphal) [Orabug: 39786232] {CVE-2026-64413}
    - staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()     (Alexandru Hossu) [Orabug: 39786307] {CVE-2026-64441}
    - PCI: mediatek: Fix IRQ domain leak when port fails to enable (Manivannan Sadhasivam) [Orabug: 39786366]     {CVE-2026-64461}
    - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (Alexandru Hossu) [Orabug:
    39786327] {CVE-2026-64446}
    - smb: client: restrict implied bcc[0] exemption to responses without data area (Shoichiro Miyamoto)     [Orabug: 39786332] {CVE-2026-64448}
    - vfio/pci: Release the VGA arbiter client on register_device() failure (Alex Williamson) [Orabug:
    39786409] {CVE-2026-64475}
    - ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup (Rafael J. Wysocki) [Orabug: 39786502]     {CVE-2026-64510}
    - ACPI: CPPC: Suppress UBSAN warning caused by field misuse (Jeremy Linton) [Orabug: 39786508]     {CVE-2026-64512}
    - net: openvswitch: reject oversized nested action attrs (Asim Viladi Oglu Manizada) [Orabug:
    39789564,39816016,39819143] {CVE-2026-64531}
    - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (Shivam Kumar) [Orabug:
    39789573] {CVE-2026-64534}
    - sctp: validate STALE_COOKIE cause length before reading staleness (Weiming Shi) [Orabug: 39794431]     {CVE-2026-64551}
    - netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (Xiang Mei) [Orabug: 39794442]     {CVE-2026-64554}
    - Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (Weiming Shi) [Orabug: 39794421]     {CVE-2026-64549}
    - net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (Xiang Mei) [Orabug: 39794412]     {CVE-2026-64547}
    - usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (Xiang Mei) [Orabug: 39794387]     {CVE-2026-64540}
    - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (Jamal Hadi Salim) [Orabug: 39787017]     {CVE-2026-64530}
    - net, bpf: check master for NULL in xdp_master_redirect() (Xiang Mei) [Orabug: 39794405] {CVE-2026-64545}
    - ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). (Xiang Mei) [Orabug: 39794379] {CVE-2026-64538}
    - drm/edid: fix OOB read in drm_parse_tiled_block() (Xiang Mei) [Orabug: 39794408] {CVE-2026-64546}
    - net: psample: fix info leak in PSAMPLE_ATTR_DATA (Jakub Kicinski) [Orabug: 39794438] {CVE-2026-64553}
    - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (Weiming Shi) [Orabug: 39794417]     {CVE-2026-64548}
    - crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (Weiming Shi) [Orabug: 39794401]     {CVE-2026-64544}
    - xfs: fail recovery on a committed log item with no regions (Weiming Shi) [Orabug: 39760871]     {CVE-2026-64187}
    - fuse: re-lock request before returning from fuse_ref_folio() (Joanne Koong) [Orabug: 39785786]     {CVE-2026-64266}
    - Input: touchwin - reset the packet index on every complete packet (Bryam Vargas) [Orabug: 39785802]     {CVE-2026-64271}
    - Input: elan_i2c - prevent division by zero and arithmetic underflow (Ranjan Kumar) [Orabug: 39785819]     {CVE-2026-64275}
    - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (Bryam Vargas) [Orabug: 39785823]     {CVE-2026-64276}
    - i2c: core: fix adapter deregistration race (Johan Hovold) [Orabug: 39785831] {CVE-2026-64279}
    - KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (Sean Christopherson)     [Orabug: 39843616] {CVE-2026-64604}
    - exfat: bound uniname advance in exfat_find_dir_entry() (Bryam Vargas) [Orabug: 39785863]     {CVE-2026-64296}
    - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (Benjamin Coddington) [Orabug: 39785868]     {CVE-2026-64298}
    - tracing: Prevent out-of-bounds read in glob matching (Huihui Huang) [Orabug: 39785872] {CVE-2026-64299}
    - crypto: drbg - Fix returning success on failure in CTR_DRBG (Eric Biggers) [Orabug: 39785893]     {CVE-2026-64306}
    - crypto: pcrypt - restore callback for non-parallel fallback (Ruijie Li) [Orabug: 39785906]     {CVE-2026-64312}
    - crypto: ecc - Fix carry overflow in vli multiplication (Anastasia Tishchenko) [Orabug: 39785910]     {CVE-2026-64313}
    - isofs: bound Rock Ridge symlink components to the SL record (Bryam Vargas) [Orabug: 39785923]     {CVE-2026-64317}
    - udf: validate sparing table length as an entry count, not a byte count (Bryam Vargas) [Orabug: 39785940]     {CVE-2026-64322}
    - udf: validate VAT header length against the VAT inode size (Bryam Vargas) [Orabug: 39785944]     {CVE-2026-64323}
    - udf: validate free block extents against the partition length (Michael Bommarito) [Orabug: 39785948]     {CVE-2026-64324}
    - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (Badhri Jagan Sridharan) [Orabug:
    39785963] {CVE-2026-64330}
    - usbip: vudc: fix NULL deref in vep_dequeue() (Sam Day) [Orabug: 39785967] {CVE-2026-64331}
    - USB: ulpi: fix memory leak on registration failure (Johan Hovold) [Orabug: 39785971] {CVE-2026-64332}
    - USB: serial: digi_acceleport: fix write buffer corruption (Johan Hovold) [Orabug: 39785975]     {CVE-2026-64333}
    - USB: serial: digi_acceleport: fix hard lockup on disconnect (Johan Hovold) [Orabug: 39785979]     {CVE-2026-64334}
    - USB: serial: digi_acceleport: fix broken rx after throttle (Johan Hovold) [Orabug: 39785983]     {CVE-2026-64335}
    - USB: serial: keyspan_pda: fix information leak (Johan Hovold) [Orabug: 39785987] {CVE-2026-64336}
    - USB: misc: uss720: unregister parport on probe failure (Myeonghun Pak) [Orabug: 39785994]     {CVE-2026-64338}
    - USB: legousbtower: fix use-after-free on disconnect race (Johan Hovold) [Orabug: 39785999]     {CVE-2026-64340}
    - USB: iowarrior: fix use-after-free on disconnect (Johan Hovold) [Orabug: 39786007] {CVE-2026-64342}
    - USB: ldusb: fix use-after-free on disconnect race (Johan Hovold) [Orabug: 39786012] {CVE-2026-64343}
    - USB: idmouse: fix use-after-free on disconnect race (Johan Hovold) [Orabug: 39786017] {CVE-2026-64344}
    - usb: gadget: udc: Fix use-after-free in gadget_match_driver (Jimmy Hu) [Orabug: 39786026]     {CVE-2026-64346}
    - usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (Maoyi Xie) [Orabug: 39786030]     {CVE-2026-64347}
    - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (Maoyi Xie) [Orabug: 39786042]     {CVE-2026-64351}
    - HID: lg-g15: cancel pending work on remove to fix a use-after-free (Maoyi Xie) [Orabug: 39786071]     {CVE-2026-64362}
    - HID: wacom: stop hardware after post-start probe failures (Myeonghun Pak) [Orabug: 39859299]     {CVE-2026-68091}
    - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Xu Wang) [Orabug: 39786091]     {CVE-2026-64370}
    - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (Yuho Choi) [Orabug: 39786100]     {CVE-2026-64372}
    - cpufreq: Fix hotplug-suspend race during reboot (Tianxiang Chen) [Orabug: 39786104] {CVE-2026-64373}
    - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT (Steven Rostedt) [Orabug: 39786108]     {CVE-2026-64374}
    - net: Drop the lock in skb_may_tx_timestamp() (Sebastian Andrzej Siewior) [Orabug: 39331701]     {CVE-2026-43216}
    - Bluetooth: L2CAP: validate option length before reading conf opt value (Muhammad Bilal) [Orabug:
    39786205] {CVE-2026-64403}
    - Bluetooth: fix UAF in bt_accept_dequeue() (Yousef Alhouseen) [Orabug: 39786578] {CVE-2026-64406}
    - Bluetooth: bnep: pin L2CAP connection during netdev registration (Yousef Alhouseen) [Orabug: 39786217]     {CVE-2026-64408}
    - netfilter: ebtables: terminate table name before find_table_lock() (Xiang Mei) [Orabug: 39786224]     {CVE-2026-64411}
    - netfilter: ebtables: module names must be null-terminated (Florian Westphal) [Orabug: 39786228]     {CVE-2026-64412}
    - mfd: cros_ec: Delay dev_set_drvdata() until probe success (Andrei Kuchynski) [Orabug: 39786248]     {CVE-2026-64420}
    - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (Wyatt Feng) [Orabug: 39786254]     {CVE-2026-64422}
    - ipv4: igmp: remove multicast group from hash table on device destruction (Yuyang Huang) [Orabug:
    39786259] {CVE-2026-64423}
    - io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (Runyu Xiao) [Orabug: 39786574]     {CVE-2026-64425}
    - audit: Fix data races of skb_queue_len() readers on audit_queue (Chi Wang) [Orabug: 39786289]     {CVE-2026-64435}
    - net: af_key: initialize alg_key_len for IPComp states (Zijing Yin) [Orabug: 39786293] {CVE-2026-64436}
    - crypto: amlogic - avoid double cleanup in meson_crypto_probe() (Dawei Feng) [Orabug: 39843604]     {CVE-2026-64599}
    - staging: rtl8723bs: fix OOB write in HT_caps_handler() (Alexandru Hossu) [Orabug: 39786303]     {CVE-2026-64440}
    - staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (Alexandru Hossu) [Orabug: 39789581]     {CVE-2026-64536}
    - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (Alexandru Hossu)     [Orabug: 39786311] {CVE-2026-64442}
    - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (Alexandru Hossu) [Orabug: 39786315]     {CVE-2026-64443}
    - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (Alexandru Hossu) [Orabug: 39786319]     {CVE-2026-64444}
    - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (Alexandru Hossu) [Orabug:
    39786323] {CVE-2026-64445}
    - tipc: fix out-of-bounds read in broadcast Gap ACK blocks (Samuel Page) [Orabug: 39786340]     {CVE-2026-64450}
    - 6lowpan: fix NHC entry use-after-free on error path (Yizhou Zhao) [Orabug: 39786344] {CVE-2026-64452}
    - usb: dwc3: run gadget disconnect from sleepable suspend context (Runyu Xiao) [Orabug: 39786349]     {CVE-2026-64454}
    - USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (Alan Stern) [Orabug: 39786352]     {CVE-2026-64455}
    - hwrng: virtio: clamp device-reported used.len at copy_data() (Michael Bommarito) [Orabug: 39786356]     {CVE-2026-64456}
    - netfilter: ipset: fix race between dump and ip_set_list resize (Xiang Mei) [Orabug: 39760883]     {CVE-2026-64189}
    - usb: xhci: Fix sleep in atomic context in xhci_free_streams() (Lianqin Hu) [Orabug: 39786379]     {CVE-2026-64465}
    - Bluetooth: btusb: fix use-after-free on marvell probe failure (Johan Hovold) [Orabug: 39786393]     {CVE-2026-64470}
    - Bluetooth: btusb: fix use-after-free on registration failure (Johan Hovold) [Orabug: 39786397]     {CVE-2026-64471}
    - ALSA: usb-audio: avoid kobject path lookup in DualSense match (Darvell Long) [Orabug: 39786416]     {CVE-2026-64478}
    - ALSA: firewire: isight: bound the sample count to the packet payload (Maoyi Xie) [Orabug: 39786428]     {CVE-2026-64483}
    - ALSA: es1938: check snd_ctl_new1() return value (Zhao Dongdong) [Orabug: 39786432] {CVE-2026-64484}
    - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (Maoyi Xie) [Orabug:
    39786439] {CVE-2026-64487}
    - iio: event: Fix event FIFO reset race (Lars-Peter Clausen) [Orabug: 39786462] {CVE-2026-64496}
    - iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (Biren Pandya) [Orabug: 39786478]     {CVE-2026-64503}
    - iio: accel: bmc150: clamp the device-reported FIFO frame count (Bryam Vargas) [Orabug: 39786482]     {CVE-2026-64504}
    - NFSv4/flexfiles: reject zero filehandle version count (Michael Bommarito) [Orabug: 39753894]     {CVE-2026-53392}
    - fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() (Mingyu Wang) [Orabug: 39753924]     {CVE-2026-53402}
    - i2c: core: fix adapter registration race (Johan Hovold) [Orabug: 39753916] {CVE-2026-53400}
    - block: Avoid mounting the bdev pseudo-filesystem in userspace (Denis Arefev) [Orabug: 39753985]     {CVE-2026-63810}
    - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Maoyi Xie) [Orabug: 39754045]     {CVE-2026-63829}
    - net: skmsg: preserve sg.copy across SG transforms (Yiming Qian) [Orabug: 39754049] {CVE-2026-63830}
    - netfilter: nf_tables: restore set elements when delete set fails (Pablo Neira Ayuso) [Orabug: 36598010]     {CVE-2024-27012}
    - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() (Sean     Christopherson) [Orabug: 39753972] {CVE-2026-63806}
    - userfaultfd: gate must_wait writability check on pte_present() (Kiryl Shutsemau) [Orabug: 39786515]     {CVE-2026-64514}
    - nfsd: reset write verifier on deferred writeback errors (Jeff Layton) [Orabug: 39753898]     {CVE-2026-53393}
    - nfsd: release layout stid on setlease failure (Chris Mason) [Orabug: 39753912] {CVE-2026-53399}
    - nvmet-tcp: fix race between ICReq handling and queue teardown (Chaitanya Kulkarni) [Orabug: 39460310]     {CVE-2026-46135}
    - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang) [Orabug:
    39558744] {CVE-2026-74684}
    - net/rds: zero per-item info buffer before handing it to visitors (Michael Bommarito) [Orabug:
    39621715,39638197] {CVE-2026-52995}
    - x86/sev: Evict cache lines during SNP memory validation (Tom Lendacky) [Orabug: 38334919]     {CVE-2025-38560}
    - xfs: resample the data fork mapping after cycling ILOCK (Darrick Wong) [Orabug: 39776791]     {CVE-2026-64600}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8876-1 advisory.

    It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory     allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could     possibly use this to cause a denial of service (system crash). (CVE-2022-3114)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM32 architecture;

    - ARM64 architecture;

    - MIPS architecture;

    - PowerPC architecture;

    - RISC-V architecture;

    - User-Mode Linux (UML);

    - x86 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - ACPI drivers;

    - Android drivers;

    - Serial ATA and Parallel ATA drivers;

    - Drivers core;

    - DRBD Distributed Replicated Block Device drivers;

    - Rados block device (RBD) driver;

    - Bluetooth drivers;

    - Cdrom driver;

    - Character device driver;

    - Hardware random number generator core;

    - TPM device driver;

    - Data acquisition framework and drivers;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - DAX dirext access to differentiated memory framework;

    - DMA engine subsystem;

    - FireWire subsystem;

    - Arm Firmware Framework for ARMv8-A(FFA);

    - Intel Stratix 10 firmware drivers;

    - GPIO subsystem;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - Intel Trace Hub HW tracing drivers;

    - I2C subsystem;

    - IIO subsystem;

    - IIO ADC drivers;

    - IIO Magnetometer sensors drivers;

    - InfiniBand drivers;

    - Input Device core drivers;

    - Input Device (Miscellaneous) drivers;

    - Input Device (Mouse) drivers;

    - IOMMU subsystem;

    - IRQ chip drivers;

    - LED subsystem;

    - Multiple devices driver;

    - Media drivers;

    - MemoryStick subsystem;

    - Multifunction device drivers;

    - Fastrpc Driver;

    - MTD block device drivers;

    - Network drivers;

    - Mellanox network drivers;

    - Microsoft Azure Network Adapter (MANA) driver;

    - Texas Instruments network drivers;

    - MediaTek network drivers;

    - NTB driver;

    - NVDIMM (Non-Volatile Memory Device) drivers;

    - NVME drivers;

    - PCI subsystem;

    - Pin controllers subsystem;

    - Generic PM domains;

    - Power supply drivers;

    - Voltage and Current Regulator drivers;

    - Reset controller framework;

    - S/390 drivers;

    - SCSI subsystem;

    - SLIMbus drivers;

    - SPI subsystem;

    - Media staging drivers;

    - Media Oriented Systems Transport (MOST) driver;

    - NVIDIA Tegra embedded controller (NVEC) staging driver;

    - Realtek RTL8723BS SDIO drivers;

    - TCM subsystem;

    - Trusted Execution Environment drivers;

    - Thermal drivers;

    - Thunderbolt and USB4 drivers;

    - USB DSL drivers;

    - Cadence USB3 driver;

    - ULPI bus;

    - DesignWare USB3 driver;

    - USB Gadget drivers;

    - USB Host Controller drivers;

    - USB ChaosKey driver;

    - Siemens ID Mouse USB driver;

    - IOWarrior USB driver;

    - LD Didactic USB driver;

    - LEGO USB Tower driver;

    - USS720 USB parallel port adapter driver;

    - MediaTek USB3 DRD driver;

    - USB Serial drivers;

    - USB Type-C Port Controller Manager driver;

    - USB Type-C Connector System Software Interface driver;

    - USB over IP driver;

    - vDPA drivers;

    - VFIO drivers;

    - Virtio Host (VHOST) subsystem;

    - Framebuffer layer;

    - Watchdog drivers;

    - Xen hypervisor drivers;

    - AFS file system;

    - File systems infrastructure;

    - BTRFS file system;

    - Ceph distributed file system;

    - EROFS file system;

    - exFAT file system;

    - Ext4 file system;

    - F2FS file system;

    - FUSE (File system in Userspace);

    - HFS file system;

    - HFS+ file system;

    - Journaling layer for block devices (JBD2);

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NILFS2 file system;

    - NTFS3 file system;

    - OCFS2 file system;

    - OrangeFS file system;

    - Proc file system;

    - SMB network file system;

    - UDF file system;

    - XFS file system;

    - Software nodes and device properties;

    - Glob pattern matching library;

    - Netfilter;

    - Socket messages infrastructure;

    - Network sockets;

    - Memory Management;

    - Network traffic control;

    - IPv6 networking;

    - Bluetooth subsystem;

    - Networking core;

    - IP tunnels definitions;

    - IPv4 networking;

    - SCTP protocol;

    - XFRM subsystem;

    - io_uring subsystem;

    - IPC subsystem;

    - Audit subsystem;

    - BPF subsystem;

    - Control group (cgroup);

    - Kernel CPU control infrastructure;

    - Kernel exit() syscall;

    - Kernel futex primitives;

    - Scheduler infrastructure;

    - Signal handling mechanism;

    - Timer subsystem;

    - Tracing infrastructure;

    - Cryptographic library;

    - Debug objects infrastructure;

    - Resizable hashtable library;

    - Memory management;

    - 6LoWPAN network protocol;

    - IEEE 802 network protocols;

    - 9P file system network protocol;

    - Asynchronous Transfer Mode (ATM) subsystem;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - CAN network layer;

    - Ceph Core library;

    - HSR network protocol;

    - IEEE802154.4 network protocol;

    - IFE protocol;

    - IUCV driver;

    - KCM (Kernel Connection Multiplexor) sockets driver;

    - Logical Link layer;

    - MAC80211 subsystem;

    - IEEE 802.15.4 subsystem;

    - Management Component Transport Protocol (MCTP);

    - MultiProtocol Label Switching driver;

    - NetLabel subsystem;

    - Open vSwitch;

    - Packet sockets;

    - Phonet protocol;

    - Packet sampling (psample);

    - Qualcomm IPC Router (QRTR);

    - RDS protocol;

    - SMC sockets;

    - Sun RPC protocol;

    - TIPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - X.25 network layer;

    - AppArmor security module;

    - Integrity Measurement Architecture(IMA) framework;

    - Key management;

    - Apple Onboard Audio ALSA driver;

    - ALSA framework;

    - Generic PCM loopback sound driver;

    - FireWire sound drivers;

    - ESS Solo-1 ALSA driver;

    - HD-audio driver;

    - SoC Audio for Freescale CPUs drivers;

    - NVIDIA Tegra ASoC drivers;

    - USB sound devices;

    - Perf tools;

    - KVM subsystem; (CVE-2023-54125, CVE-2023-54271, CVE-2025-22026, CVE-2025-23131, CVE-2025-39863,     CVE-2025-39929, CVE-2025-39931, CVE-2026-23364, CVE-2026-31449, CVE-2026-31451, CVE-2026-31610,     CVE-2026-31700, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712, CVE-2026-31715,     CVE-2026-43064, CVE-2026-43216, CVE-2026-43219, CVE-2026-43350, CVE-2026-43355, CVE-2026-43491,     CVE-2026-43492, CVE-2026-45850, CVE-2026-45930, CVE-2026-45991, CVE-2026-45999, CVE-2026-46003,     CVE-2026-46021, CVE-2026-46026, CVE-2026-46038, CVE-2026-46052, CVE-2026-46056, CVE-2026-46065,     CVE-2026-46069, CVE-2026-46078, CVE-2026-46086, CVE-2026-46090, CVE-2026-46091, CVE-2026-46092,     CVE-2026-46103, CVE-2026-46116, CVE-2026-46159, CVE-2026-46160, CVE-2026-46169, CVE-2026-46180,     CVE-2026-46191, CVE-2026-46193, CVE-2026-46196, CVE-2026-46208, CVE-2026-46252, CVE-2026-46291,     CVE-2026-46292, CVE-2026-46299, CVE-2026-46320, CVE-2026-46321, CVE-2026-46322, CVE-2026-52909,     CVE-2026-52910, CVE-2026-52913, CVE-2026-52917, CVE-2026-52918, CVE-2026-52923, CVE-2026-52927,     CVE-2026-52928, CVE-2026-52929, CVE-2026-52930, CVE-2026-52933, CVE-2026-52934, CVE-2026-52935,     CVE-2026-52939, CVE-2026-52942, CVE-2026-52943, CVE-2026-52947, CVE-2026-52948, CVE-2026-52977,     CVE-2026-53080, CVE-2026-53090, CVE-2026-53133, CVE-2026-53134, CVE-2026-53135, CVE-2026-53136,     CVE-2026-53137, CVE-2026-53138, CVE-2026-53139, CVE-2026-53146, CVE-2026-53148, CVE-2026-53149,     CVE-2026-53150, CVE-2026-53157, CVE-2026-53158, CVE-2026-53159, CVE-2026-53161, CVE-2026-53167,     CVE-2026-53168, CVE-2026-53177, CVE-2026-53181, CVE-2026-53189, CVE-2026-53194, CVE-2026-53195,     CVE-2026-53196, CVE-2026-53199, CVE-2026-53208, CVE-2026-53213, CVE-2026-53217, CVE-2026-53218,     CVE-2026-53219, CVE-2026-53223, CVE-2026-53227, CVE-2026-53238, CVE-2026-53239, CVE-2026-53245,     CVE-2026-53249, CVE-2026-53252, CVE-2026-53253, CVE-2026-53254, CVE-2026-53255, CVE-2026-53256,     CVE-2026-53263, CVE-2026-53264, CVE-2026-53265, CVE-2026-53266, CVE-2026-53268, CVE-2026-53269,     CVE-2026-53270, CVE-2026-53273, CVE-2026-53275, CVE-2026-53325, CVE-2026-53332, CVE-2026-53392,     CVE-2026-53393, CVE-2026-53399, CVE-2026-53400, CVE-2026-53402, CVE-2026-63806, CVE-2026-63810,     CVE-2026-63815, CVE-2026-63817, CVE-2026-63818, CVE-2026-63827, CVE-2026-63828, CVE-2026-63829,     CVE-2026-63830, CVE-2026-64187, CVE-2026-64189, CVE-2026-64206, CVE-2026-64266, CVE-2026-64268,     CVE-2026-64269, CVE-2026-64271, CVE-2026-64273, CVE-2026-64274, CVE-2026-64275, CVE-2026-64276,     CVE-2026-64277, CVE-2026-64279, CVE-2026-64296, CVE-2026-64298, CVE-2026-64299, CVE-2026-64301,     CVE-2026-64303, CVE-2026-64304, CVE-2026-64306, CVE-2026-64312, CVE-2026-64313, CVE-2026-64315,     CVE-2026-64316, CVE-2026-64317, CVE-2026-64318, CVE-2026-64322, CVE-2026-64323, CVE-2026-64324,     CVE-2026-64329, CVE-2026-64330, CVE-2026-64331, CVE-2026-64332, CVE-2026-64333, CVE-2026-64334,     CVE-2026-64335, CVE-2026-64336, CVE-2026-64337, CVE-2026-64338, CVE-2026-64340, CVE-2026-64342,     CVE-2026-64343, CVE-2026-64344, CVE-2026-64346, CVE-2026-64347, CVE-2026-64350, CVE-2026-64351,     CVE-2026-64352, CVE-2026-64355, CVE-2026-64359, CVE-2026-64360, CVE-2026-64361, CVE-2026-64362,     CVE-2026-64363, CVE-2026-64364, CVE-2026-64370, CVE-2026-64371, CVE-2026-64372, CVE-2026-64373,     CVE-2026-64374, CVE-2026-64375, CVE-2026-64379, CVE-2026-64380, CVE-2026-64381, CVE-2026-64390,     CVE-2026-64401, CVE-2026-64403, CVE-2026-64408, CVE-2026-64411, CVE-2026-64412, CVE-2026-64413,     CVE-2026-64420, CVE-2026-64422, CVE-2026-64423, CVE-2026-64425, CVE-2026-64428, CVE-2026-64429,     CVE-2026-64430, CVE-2026-64432, CVE-2026-64435, CVE-2026-64436, CVE-2026-64438, CVE-2026-64440,     CVE-2026-64441, CVE-2026-64442, CVE-2026-64443, CVE-2026-64444, CVE-2026-64445, CVE-2026-64446,     CVE-2026-64448, CVE-2026-64450, CVE-2026-64452, CVE-2026-64454, CVE-2026-64455, CVE-2026-64456,     CVE-2026-64461, CVE-2026-64462, CVE-2026-64465, CVE-2026-64468, CVE-2026-64469, CVE-2026-64470,     CVE-2026-64471, CVE-2026-64475, CVE-2026-64478, CVE-2026-64483, CVE-2026-64484, CVE-2026-64487,     CVE-2026-64488, CVE-2026-64494, CVE-2026-64495, CVE-2026-64496, CVE-2026-64497, CVE-2026-64500,     CVE-2026-64503, CVE-2026-64504, CVE-2026-64505, CVE-2026-64510, CVE-2026-64512, CVE-2026-64514,     CVE-2026-64530, CVE-2026-64532, CVE-2026-64533, CVE-2026-64534, CVE-2026-64535, CVE-2026-64536,     CVE-2026-64537, CVE-2026-64538, CVE-2026-64540, CVE-2026-64541, CVE-2026-64543, CVE-2026-64544,     CVE-2026-64545, CVE-2026-64546, CVE-2026-64547, CVE-2026-64548, CVE-2026-64549, CVE-2026-64550,     CVE-2026-64551, CVE-2026-64553, CVE-2026-64554, CVE-2026-64560, CVE-2026-64562, CVE-2026-64563,     CVE-2026-64564, CVE-2026-64565, CVE-2026-64567, CVE-2026-64569, CVE-2026-64571, CVE-2026-64572,     CVE-2026-64573, CVE-2026-64576, CVE-2026-64578, CVE-2026-64579, CVE-2026-64582, CVE-2026-64583,     CVE-2026-64584, CVE-2026-64593, CVE-2026-64594, CVE-2026-64599, CVE-2026-64600, CVE-2026-64602,     CVE-2026-64604, CVE-2026-68088, CVE-2026-68090, CVE-2026-68091, CVE-2026-68104, CVE-2026-68106,     CVE-2026-68111, CVE-2026-68115, CVE-2026-68117, CVE-2026-68121, CVE-2026-68123, CVE-2026-68125,     CVE-2026-68127, CVE-2026-68129, CVE-2026-68131, CVE-2026-68135, CVE-2026-68137, CVE-2026-68140,     CVE-2026-68141, CVE-2026-68142, CVE-2026-68143, CVE-2026-68144, CVE-2026-68151, CVE-2026-68153,     CVE-2026-68154, CVE-2026-68155, CVE-2026-68156, CVE-2026-68157, CVE-2026-68158, CVE-2026-68160,     CVE-2026-68175, CVE-2026-68176, CVE-2026-68180, CVE-2026-68182, CVE-2026-68183, CVE-2026-68184,     CVE-2026-68186, CVE-2026-68187, CVE-2026-68188, CVE-2026-68190, CVE-2026-68192, CVE-2026-68195,     CVE-2026-68196, CVE-2026-68197, CVE-2026-68199, CVE-2026-68204, CVE-2026-68209, CVE-2026-68212,     CVE-2026-68213, CVE-2026-68214, CVE-2026-68215, CVE-2026-68216, CVE-2026-68217, CVE-2026-68218,     CVE-2026-68222, CVE-2026-68223, CVE-2026-68226, CVE-2026-68227, CVE-2026-68229, CVE-2026-68231,     CVE-2026-68234, CVE-2026-68243, CVE-2026-68244, CVE-2026-68248, CVE-2026-68249, CVE-2026-68250,     CVE-2026-68284, CVE-2026-68294, CVE-2026-68297, CVE-2026-68299, CVE-2026-68300, CVE-2026-68301,     CVE-2026-68304, CVE-2026-68309, CVE-2026-68313, CVE-2026-68315, CVE-2026-68320, CVE-2026-68322,     CVE-2026-68324, CVE-2026-68325, CVE-2026-68326, CVE-2026-68327, CVE-2026-68328, CVE-2026-68331,     CVE-2026-68333, CVE-2026-68335, CVE-2026-68338, CVE-2026-68340, CVE-2026-68349, CVE-2026-68350,     CVE-2026-68351, CVE-2026-68352, CVE-2026-68353, CVE-2026-68354, CVE-2026-68355, CVE-2026-68357,     CVE-2026-68360, CVE-2026-68361, CVE-2026-68363, CVE-2026-68365, CVE-2026-68366, CVE-2026-68368,     CVE-2026-68369, CVE-2026-68370, CVE-2026-68373, CVE-2026-68376, CVE-2026-68377, CVE-2026-68388,     CVE-2026-68395, CVE-2026-68397, CVE-2026-68398, CVE-2026-68402, CVE-2026-68403, CVE-2026-68405,     CVE-2026-68406, CVE-2026-68410, CVE-2026-68411, CVE-2026-68413, CVE-2026-68414, CVE-2026-68417,     CVE-2026-68422, CVE-2026-68425, CVE-2026-68428, CVE-2026-68430, CVE-2026-68432, CVE-2026-68433,     CVE-2026-68444, CVE-2026-68446, CVE-2026-68449, CVE-2026-68450, CVE-2026-68451, CVE-2026-68452,     CVE-2026-68456, CVE-2026-68459, CVE-2026-68460, CVE-2026-68461, CVE-2026-68466, CVE-2026-68467,     CVE-2026-68469, CVE-2026-68474, CVE-2026-68475, CVE-2026-68477, CVE-2026-68478, CVE-2026-68479,     CVE-2026-68480, CVE-2026-72004, CVE-2026-72005, CVE-2026-72010, CVE-2026-72013, CVE-2026-72014,     CVE-2026-72019, CVE-2026-72020, CVE-2026-72021, CVE-2026-72022, CVE-2026-72024, CVE-2026-72025,     CVE-2026-72033, CVE-2026-72036, CVE-2026-72038, CVE-2026-72039, CVE-2026-72047, CVE-2026-72048,     CVE-2026-72049, CVE-2026-72052, CVE-2026-72054, CVE-2026-72055, CVE-2026-72056, CVE-2026-72061,     CVE-2026-72066, CVE-2026-72067, CVE-2026-72068, CVE-2026-72074, CVE-2026-72076, CVE-2026-72078,     CVE-2026-72079, CVE-2026-72081, CVE-2026-72082, CVE-2026-72083, CVE-2026-72084, CVE-2026-72085,     CVE-2026-72086, CVE-2026-72088, CVE-2026-72102, CVE-2026-72105, CVE-2026-72107, CVE-2026-72108,     CVE-2026-72109, CVE-2026-72113, CVE-2026-72114, CVE-2026-72115, CVE-2026-72116, CVE-2026-72117,     CVE-2026-72118, CVE-2026-72119, CVE-2026-72120, CVE-2026-72121, CVE-2026-72122, CVE-2026-72123,     CVE-2026-72124, CVE-2026-72125, CVE-2026-72126, CVE-2026-72129, CVE-2026-72133, CVE-2026-72135,     CVE-2026-72136, CVE-2026-72138, CVE-2026-72140, CVE-2026-72146, CVE-2026-72153, CVE-2026-72159,     CVE-2026-72160, CVE-2026-72163, CVE-2026-72164, CVE-2026-72165, CVE-2026-72166, CVE-2026-72167,     CVE-2026-72171, CVE-2026-72181, CVE-2026-72182, CVE-2026-72192, CVE-2026-72193, CVE-2026-72194,     CVE-2026-72195, CVE-2026-72197, CVE-2026-72215, CVE-2026-72218, CVE-2026-72219, CVE-2026-72223,     CVE-2026-72224, CVE-2026-72225, CVE-2026-72226, CVE-2026-72228, CVE-2026-72229, CVE-2026-72230,     CVE-2026-72231, CVE-2026-72232, CVE-2026-72233, CVE-2026-72234, CVE-2026-72235, CVE-2026-72238,     CVE-2026-72240, CVE-2026-72241, CVE-2026-72245, CVE-2026-72247, CVE-2026-72250, CVE-2026-72251,     CVE-2026-72256, CVE-2026-72264, CVE-2026-72265, CVE-2026-72267, CVE-2026-72268, CVE-2026-72269,     CVE-2026-72270, CVE-2026-72271, CVE-2026-72272, CVE-2026-72274, CVE-2026-72275, CVE-2026-72276,     CVE-2026-72282, CVE-2026-72289, CVE-2026-72296, CVE-2026-72297, CVE-2026-72298, CVE-2026-72306,     CVE-2026-72307, CVE-2026-72310, CVE-2026-72314, CVE-2026-72316, CVE-2026-72319, CVE-2026-72322,     CVE-2026-72326, CVE-2026-72339, CVE-2026-72347, CVE-2026-72348, CVE-2026-72349, CVE-2026-72350,     CVE-2026-72351, CVE-2026-72371, CVE-2026-72374, CVE-2026-72378, CVE-2026-72389, CVE-2026-72392,     CVE-2026-72396, CVE-2026-72400, CVE-2026-72406, CVE-2026-72409, CVE-2026-72414, CVE-2026-72418,     CVE-2026-72421, CVE-2026-72422, CVE-2026-72428, CVE-2026-72433, CVE-2026-72435, CVE-2026-72441,     CVE-2026-72447, CVE-2026-72448, CVE-2026-72450, CVE-2026-72459, CVE-2026-72460, CVE-2026-72466,     CVE-2026-72476, CVE-2026-72479, CVE-2026-72481, CVE-2026-72483, CVE-2026-72484, CVE-2026-72489,     CVE-2026-72491, CVE-2026-72492, CVE-2026-72502, CVE-2026-74255, CVE-2026-74256, CVE-2026-74262,     CVE-2026-74265, CVE-2026-74267, CVE-2026-74276, CVE-2026-74279, CVE-2026-74280, CVE-2026-74281,     CVE-2026-74282, CVE-2026-74283, CVE-2026-74284, CVE-2026-74287, CVE-2026-74288, CVE-2026-74292,     CVE-2026-74293, CVE-2026-74295, CVE-2026-74297, CVE-2026-74305, CVE-2026-74312, CVE-2026-74313,     CVE-2026-74320, CVE-2026-74321, CVE-2026-74327, CVE-2026-74329, CVE-2026-74330, CVE-2026-74331,     CVE-2026-74339, CVE-2026-74340, CVE-2026-74346, CVE-2026-74348, CVE-2026-74349, CVE-2026-74351,     CVE-2026-74359, CVE-2026-74363, CVE-2026-74376, CVE-2026-74379, CVE-2026-74382, CVE-2026-74384,     CVE-2026-74390, CVE-2026-74394, CVE-2026-74395, CVE-2026-74398, CVE-2026-74399, CVE-2026-74402,     CVE-2026-74408, CVE-2026-74410, CVE-2026-74416, CVE-2026-74424, CVE-2026-74426, CVE-2026-74427,     CVE-2026-74438, CVE-2026-74443, CVE-2026-74444, CVE-2026-74453, CVE-2026-74455, CVE-2026-74456,     CVE-2026-74457, CVE-2026-74458, CVE-2026-74459, CVE-2026-74460, CVE-2026-74461, CVE-2026-74463,     CVE-2026-74464, CVE-2026-74465, CVE-2026-74467, CVE-2026-74468, CVE-2026-74469, CVE-2026-74471,     CVE-2026-74473, CVE-2026-74475, CVE-2026-74478, CVE-2026-74480, CVE-2026-74481, CVE-2026-74482,     CVE-2026-74485, CVE-2026-74488, CVE-2026-74490, CVE-2026-74492, CVE-2026-74493, CVE-2026-74495,     CVE-2026-74497, CVE-2026-74498, CVE-2026-74499, CVE-2026-74505, CVE-2026-74507, CVE-2026-74508,     CVE-2026-74512, CVE-2026-74518, CVE-2026-74519, CVE-2026-74523, CVE-2026-74525, CVE-2026-74540,     CVE-2026-74546, CVE-2026-74547, CVE-2026-74548, CVE-2026-74549, CVE-2026-74556, CVE-2026-74557,     CVE-2026-74563, CVE-2026-74564, CVE-2026-74566, CVE-2026-74567, CVE-2026-74569, CVE-2026-74577,     CVE-2026-74578, CVE-2026-74579)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793333110 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: dma-debug: don't call
    __dma_entry_alloc_check_leak() under free_entries_lock __dma_entry_alloc_check_leak() calls into printk ->     serial console output (qcom geni) and grabs port->lock under free_entries_lock spin lock, which is a     reverse locking dependency chain as qcom_geni IRQ handler can call into dma-debug code and grab     free_entries_lock under port->lock. Move __dma_entry_alloc_check_leak() call out of free_entries_lock     scope so that we don't acquire serial console's port->lock under it. Trimmed-down lockdep splat: The     existing dependency chain (in reverse order) is: -> #2 (free_entries_lock){-.-.}-{2:2}:
    _raw_spin_lock_irqsave+0x60/0x80 dma_entry_alloc+0x38/0x110 debug_dma_map_page+0x60/0xf8     dma_map_page_attrs+0x1e0/0x230 dma_map_single_attrs.constprop.0+0x6c/0xc8 geni_se_rx_dma_prep+0x40/0xcc     qcom_geni_serial_isr+0x310/0x510 __handle_irq_event_percpu+0x110/0x244 handle_irq_event_percpu+0x20/0x54     handle_irq_event+0x50/0x88 handle_fasteoi_irq+0xa4/0xcc handle_irq_desc+0x28/0x40     generic_handle_domain_irq+0x24/0x30 gic_handle_irq+0xc4/0x148 do_interrupt_handler+0xa4/0xb0     el1_interrupt+0x34/0x64 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x64/0x68 arch_local_irq_enable+0x4/0x8
    ____do_softirq+0x18/0x24 ... -> #1 (&port_lock_key){-.-.}-{2:2}: _raw_spin_lock_irqsave+0x60/0x80     qcom_geni_serial_console_write+0x184/0x1dc console_flush_all+0x344/0x454 console_unlock+0x94/0xf0     vprintk_emit+0x238/0x24c vprintk_default+0x3c/0x48 vprintk+0xb4/0xbc _printk+0x68/0x90     register_console+0x230/0x38c uart_add_one_port+0x338/0x494 qcom_geni_serial_probe+0x390/0x424     platform_probe+0x70/0xc0 really_probe+0x148/0x280 __driver_probe_device+0xfc/0x114     driver_probe_device+0x44/0x100 __device_attach_driver+0x64/0xdc bus_for_each_drv+0xb0/0xd8
    __device_attach+0xe4/0x140 device_initial_probe+0x1c/0x28 bus_probe_device+0x44/0xb0     device_add+0x538/0x668 of_device_add+0x44/0x50 of_platform_device_create_pdata+0x94/0xc8     of_platform_bus_create+0x270/0x304 of_platform_populate+0xac/0xc4 devm_of_platform_populate+0x60/0xac     geni_se_probe+0x154/0x160 platform_probe+0x70/0xc0 ... -> #0 (console_owner){-...}-{0:0}:
    __lock_acquire+0xdf8/0x109c lock_acquire+0x234/0x284 console_flush_all+0x330/0x454     console_unlock+0x94/0xf0 vprintk_emit+0x238/0x24c vprintk_default+0x3c/0x48 vprintk+0xb4/0xbc
    _printk+0x68/0x90 dma_entry_alloc+0xb4/0x110 debug_dma_map_sg+0xdc/0x2f8 __dma_map_sg_attrs+0xac/0xe4     dma_map_sgtable+0x30/0x4c get_pages+0x1d4/0x1e4 [msm] msm_gem_pin_pages_locked+0x38/0xac [msm]     msm_gem_pin_vma_locked+0x58/0x88 [msm] msm_ioctl_gem_submit+0xde4/0x13ac [msm] drm_ioctl_kernel+0xe0/0x15c     drm_ioctl+0x2e8/0x3f4 vfs_ioctl+0x30/0x50 ... Chain exists of: console_owner --> &port_lock_key -->     free_entries_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(free_entries_lock);
    lock(&port_lock_key); lock(free_entries_lock); lock(console_owner); *** DEADLOCK *** Call trace:
    dump_backtrace+0xb4/0xf0 show_stack+0x20/0x30 dump_stack_lvl+0x60/0x84 dump_stack+0x18/0x24     print_circular_bug+0x1cc/0x234 check_noncircular+0x78/0xac __lock_acquire+0xdf8/0x109c     lock_acquire+0x234/0x284 console_flush_all+0x330/0x454 consol ---truncated--- (CVE-2023-52516)

  - In the Linux kernel, the following vulnerability has been resolved: USB: sisusbvga: Add endpoint checks     The syzbot fuzzer was able to provoke a WARNING from the sisusbvga driver: ------------[ cut here     ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 26 at     drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU:
    1 PID: 26 Comm: kworker/1:1 Not tainted 6.2.0-rc5-syzkaller-00199-g5af6ce704936 #0 Hardware name: Google     Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Workqueue: usb_hub_wq hub_event RIP:
    0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 6c 50 80 fb 48 8b 7c 24 18     e8 62 1a 01 ff 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 60 b1 fa 8a e8 84 b0 be 03 <0f> 0b e9 58 f8 ff     ff e8 3e 50 80 fb 48 81 c5 c0 05 00 00 e9 84 f7 RSP: 0018:ffffc90000a1ed18 EFLAGS: 00010282 RAX:
    0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff888012783a80 RSI: ffffffff816680ec     RDI: fffff52000143d95 RBP: ffff888079020000 R08: 0000000000000005 R09: 0000000000000000 R10:
    0000000080000000 R11: 0000000000000000 R12: 0000000000000003 R13: ffff888017d33370 R14: 0000000000000003     R15: ffff888021213600 FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010     DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005592753a60b0 CR3: 0000000022899000 CR4: 00000000003506e0     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6:
    00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> sisusb_bulkout_msg     drivers/usb/misc/sisusbvga/sisusbvga.c:224 [inline] sisusb_send_bulk_msg.constprop.0+0x904/0x1230     drivers/usb/misc/sisusbvga/sisusbvga.c:379 sisusb_send_bridge_packet     drivers/usb/misc/sisusbvga/sisusbvga.c:567 [inline] sisusb_do_init_gfxdevice     drivers/usb/misc/sisusbvga/sisusbvga.c:2077 [inline] sisusb_init_gfxdevice+0x87b/0x4000     drivers/usb/misc/sisusbvga/sisusbvga.c:2177 sisusb_probe+0x9cd/0xbe2     drivers/usb/misc/sisusbvga/sisusbvga.c:2869 ... The problem was caused by the fact that the driver does     not check whether the endpoints it uses are actually present and have the appropriate types. This can be     fixed by adding a simple check of the endpoints. (CVE-2023-54213)

  - In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: use the backlog     for mirred ingress The test Davide added in commit ca22da2fbd69 (act_mirred: use the backlog for nested     calls to mirred ingress) hangs our testing VMs every 10 or so runs, with the familiar tcp_v4_rcv ->     tcp_v4_rcv deadlock reported by lockdep. The problem as previously described by Davide (see Link) is that     if we reverse flow of traffic with the redirect (egress -> ingress) we may reach the same socket which     generated the packet. And we may still be holding its socket lock. The common solution to such deadlocks     is to put the packet in the Rx backlog, rather than run the Rx path inline. Do that for all egress ->     ingress reversals, not just once we started to nest mirred calls. In the past there was a concern that the     backlog indirection will lead to loss of error reporting / less accurate stats. But the current workaround     does not seem to address the issue. (CVE-2024-26740)

  - In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: fix a bug calling     wakeup_kswapd() with a wrong zone index With numa balancing on, when a numa system is running where a numa     node doesn't have its local memory so it has no managed zones, the following oops has been observed. It's     because wakeup_kswapd() is called with a wrong zone index, -1. Fixed it by checking the index before     calling wakeup_kswapd(). > BUG: unable to handle page fault for address: 00000000000033f3 > #PF:
    supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > PGD 0 P4D 0 > Oops:
    0000 [#1] PREEMPT SMP NOPTI > CPU: 2 PID: 895 Comm: masim Not tainted 6.6.0-dirty #255 > Hardware name:
    QEMU Standard PC (i440FX + PIIX, 1996), BIOS > rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 >     RIP: 0010:wakeup_kswapd (./linux/mm/vmscan.c:7812) > Code: (omitted) > RSP: 0000:ffffc90004257d58 EFLAGS:
    00010286 > RAX: ffffffffffffffff RBX: ffff88883fff0480 RCX: 0000000000000003 > RDX: 0000000000000000 RSI:
    0000000000000000 RDI: ffff88883fff0480 > RBP: ffffffffffffffff R08: ff0003ffffffffff R09: ffffffffffffffff     > R10: ffff888106c95540 R11: 0000000055555554 R12: 0000000000000003 > R13: 0000000000000000 R14:
    0000000000000000 R15: ffff88883fff0940 > FS: 00007fc4b8124740(0000) GS:ffff888827c00000(0000)     knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00000000000033f3 CR3:
    000000026cc08004 CR4: 0000000000770ee0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000     > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > PKRU: 55555554 > Call Trace: >     <TASK> > ? __die > ? page_fault_oops > ? __pte_offset_map_lock > ? exc_page_fault > ? asm_exc_page_fault >     ? wakeup_kswapd > migrate_misplaced_page > __handle_mm_fault > handle_mm_fault > do_user_addr_fault >     exc_page_fault > asm_exc_page_fault > RIP: 0033:0x55b897ba0808 > Code: (omitted) > RSP:
    002b:00007ffeefa821a0 EFLAGS: 00010287 > RAX: 000055b89983acd0 RBX: 00007ffeefa823f8 RCX: 000055b89983acd0     > RDX: 00007fc2f8122010 RSI: 0000000000020000 RDI: 000055b89983acd0 > RBP: 00007ffeefa821a0 R08:
    0000000000000037 R09: 0000000000000075 > R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000     > R13: 00007ffeefa82410 R14: 000055b897ba5dd8 R15: 00007fc4b8340000 > </TASK> (CVE-2024-26783)

  - In the Linux kernel, the following vulnerability has been resolved: vfs: Don't evict inode under the inode     lru traversing context The inode reclaiming process(See function prune_icache_sb) collects all reclaimable     inodes and mark them with I_FREEING flag at first, at that time, other processes will be stuck if they try     getting these inodes (See function find_inode_fast), then the reclaiming process destroy the inodes by     function dispose_list(). Some filesystems(eg. ext4 with ea_inode feature, ubifs with xattr) may do inode     lookup in the inode evicting callback function, if the inode lookup is operated under the inode lru     traversing context, deadlock problems may happen. Case 1: In function ext4_evict_inode(), the ea inode     lookup could happen if ea_inode feature is enabled, the lookup process will be stuck under the evicting     context like this: 1. File A has inode i_reg and an ea inode i_ea 2. getfattr(A, xattr_buf) // i_ea is     added into lru // lru->i_ea 3. Then, following three processes running like this: PA PB echo 2 >     /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // i_reg is added into lru, lru->i_ea->i_reg     prune_icache_sb list_lru_walk_one inode_lru_isolate i_ea->i_state |= I_FREEING // set inode state     inode_lru_isolate __iget(i_reg) spin_unlock(&i_reg->i_lock) spin_unlock(lru_lock) rm file A i_reg->nlink =     0 iput(i_reg) // i_reg->nlink is 0, do evict ext4_evict_inode ext4_xattr_delete_inode     ext4_xattr_inode_dec_ref_all ext4_xattr_inode_iget ext4_iget(i_ea->i_ino) iget_locked find_inode_fast
    __wait_on_freeing_inode(i_ea) ---- AA deadlock dispose_list // cannot be executed by prune_icache_sb     wake_up_bit(&i_ea->i_state) Case 2: In deleted inode writing function ubifs_jnl_write_inode(), file     deleting process holds BASEHD's wbuf->io_mutex while getting the xattr inode, which could race with inode     reclaiming process(The reclaiming process could try locking BASEHD's wbuf->io_mutex in inode evicting     function), then an ABBA deadlock problem would happen as following: 1. File A has inode ia and a     xattr(with inode ixa), regular file B has inode ib and a xattr. 2. getfattr(A, xattr_buf) // ixa is added     into lru // lru->ixa 3. Then, following three processes running like this: PA PB PC echo 2 >     /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // ib and ia are added into lru, lru->ixa->ib->ia     prune_icache_sb list_lru_walk_one inode_lru_isolate ixa->i_state |= I_FREEING // set inode state     inode_lru_isolate __iget(ib) spin_unlock(&ib->i_lock) spin_unlock(lru_lock) rm file B ib->nlink = 0 rm     file A iput(ia) ubifs_evict_inode(ia) ubifs_jnl_delete_inode(ia) ubifs_jnl_write_inode(ia)     make_reservation(BASEHD) // Lock wbuf->io_mutex ubifs_iget(ixa->i_ino) iget_locked find_inode_fast
    __wait_on_freeing_inode(ixa) | iput(ib) // ib->nlink is 0, do evict | ubifs_evict_inode |     ubifs_jnl_delete_inode(ib)  ubifs_jnl_write_inode ABBA deadlock -----make_reservation(BASEHD)     dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&ixa->i_state) Fix the possible deadlock     by using new inode state flag I_LRU_ISOLATING to pin the inode in memory while inode_lru_isolate(
    ---truncated--- (CVE-2024-45003)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789986443 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix middle attribute     validation in push_nsh() action The push_nsh() action structure looks like this:
    OVS_ACTION_ATTR_PUSH_NSH(OVS_KEY_ATTR_NSH(OVS_NSH_KEY_ATTR_BASE,...)) The outermost     OVS_ACTION_ATTR_PUSH_NSH attribute is OK'ed by the nla_for_each_nested() inside __ovs_nla_copy_actions().
    The innermost OVS_NSH_KEY_ATTR_BASE/MD1/MD2 are OK'ed by the nla_for_each_nested() inside     nsh_key_put_from_nlattr(). But nothing checks if the attribute in the middle is OK. We don't even check     that this attribute is the OVS_KEY_ATTR_NSH. We just do a double unwrap with a pair of nla_data() calls -     first time directly while calling validate_push_nsh() and the second time as part of the     nla_for_each_nested() macro, which isn't safe, potentially causing invalid memory access if the size of     this attribute is incorrect. The failure may not be noticed during validation due to larger netlink     buffer, but cause trouble later during action execution where the buffer is allocated exactly to the size:
    BUG: KASAN: slab-out-of-bounds in nsh_hdr_from_nlattr+0x1dd/0x6a0 [openvswitch] Read of size 184 at addr     ffff88816459a634 by task a.out/22624 CPU: 8 UID: 0 PID: 22624 6.18.0-rc7+ #115 PREEMPT(voluntary) Call     Trace: <TASK> dump_stack_lvl+0x51/0x70 print_address_description.constprop.0+0x2c/0x390     kasan_report+0xdd/0x110 kasan_check_range+0x35/0x1b0 __asan_memcpy+0x20/0x60     nsh_hdr_from_nlattr+0x1dd/0x6a0 [openvswitch] push_nsh+0x82/0x120 [openvswitch]     do_execute_actions+0x1405/0x2840 [openvswitch] ovs_execute_actions+0xd5/0x3b0 [openvswitch]     ovs_packet_cmd_execute+0x949/0xdb0 [openvswitch] genl_family_rcv_msg_doit+0x1d6/0x2b0     genl_family_rcv_msg+0x336/0x580 genl_rcv_msg+0x9f/0x130 netlink_rcv_skb+0x11f/0x370 genl_rcv+0x24/0x40     netlink_unicast+0x73e/0xaa0 netlink_sendmsg+0x744/0xbf0 __sys_sendto+0x3d6/0x450 do_syscall_64+0x79/0x2c0     entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Let's add some checks that the attribute is properly     sized and it's the only one attribute inside the action. Technically, there is no real reason for     OVS_KEY_ATTR_NSH to be there, as we know that we're pushing an NSH header already, it just creates extra     nesting, but that's how uAPI works today. So, keeping as it is. (CVE-2025-68785)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix fils_discovery     double free on alloc failure ieee80211_set_fils_discovery() calls kfree_rcu() on the old template before     allocating the replacement. If the kzalloc() then fails, it returns -ENOMEM while     link->u.ap.fils_discovery still points at the object already queued for freeing. A later update or AP     teardown (ieee80211_stop_ap()) re-queues that same rcu_head; the second free is caught by KASAN when the     RCU sheaf is processed in softirq: BUG: KASAN: double-free in rcu_free_sheaf (mm/slub.c:5850) Free of addr     ffff88800c065280 by task swapper/0/0 ... __rcu_free_sheaf_prepare (mm/slub.c:2634 mm/slub.c:2940)     rcu_free_sheaf (mm/slub.c:5850) rcu_core (kernel/rcu/tree.c:2617 kernel/rcu/tree.c:2869) handle_softirqs     (kernel/softirq.c:622) The buggy address belongs to the cache kmalloc-96 of size 96 Queue the old object     for kfree_rcu() only after the new one is published, matching ieee80211_set_probe_resp() and     ieee80211_set_s1g_short_beacon(). (CVE-2026-64570)

  - In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use kvzalloc to     allocate struct dc struct dc has grown large over time (most of it the two inlined dc_scratch_space     copies) and now sits close to the page allocator's 4 MiB contiguous allocation limit. Its actual size is     not fixed by the source alone, it also depends on the compiler and the .config, so it can easily cross 4     MiB, e.g. with a newer GCC or a config change. dc_create() allocates it with kzalloc(). Once struct dc     exceeds 4 MiB the request is rounded up to order 11 (8 MiB), which is above MAX_PAGE_ORDER, so the page     allocator warns and returns NULL. dc_create() then fails, DM init fails and amdgpu probe aborts with
    -EINVAL: WARNING: mm/page_alloc.c:5197 at __alloc_frozen_pages_noprof+0x2f9/0x380 dc_create+0x38/0x660     [amdgpu] amdgpu_dm_init+0x2d9/0x510 [amdgpu] dm_hw_init+0x1b/0x90 [amdgpu]     amdgpu_device_init.cold+0x150d/0x1e13 [amdgpu] amdgpu_driver_load_kms+0x19/0x80 [amdgpu]     amdgpu_pci_probe+0x1e2/0x4c0 [amdgpu] dc_create() then returns NULL and DM init fails, which aborts the     whole GPU init and makes amdgpu probe fail with -EINVAL (hw_init of IP block <dm> failed -22), leaving     the display unusable. The subsequent amdgpu_irq_put() warnings during teardown are just fallout of     unwinding a half-initialized device. struct dc is a software-only bookkeeping structure that is never     handed to hardware DMA and is only ever kept as an opaque pointer, so it does not require physically     contiguous memory. Allocate it with kvzalloc() (and free it with kvfree()) so that the allocator can fall     back to vmalloc() when a contiguous allocation of that size is not available, which also avoids the     MAX_PAGE_ORDER warning entirely. v2: - Rebase to amd-staging-drm-next. (cherry picked from commit     991e0516a8072f2292681c6ae98a924ab0e32575) (CVE-2026-68436)

  - In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in     update_super_work when racing with umount Commit b98535d09179 (ext4: fix bug_on in start_this_handle     during umount filesystem) moved ext4_unregister_sysfs() before flushing s_sb_upd_work to prevent new     error work from being queued via /proc/fs/ext4/xx/mb_groups reads during unmount. However, this introduced     a use-after-free because update_super_work calls ext4_notify_error_sysfs() -> sysfs_notify() which     accesses the kobject's kernfs_node after it has been freed by kobject_del() in ext4_unregister_sysfs():
    update_super_work ext4_put_super ----------------- -------------- ext4_unregister_sysfs(sb)     kobject_del(&sbi->s_kobj) __kobject_del() sysfs_remove_dir() kobj->sd = NULL sysfs_put(sd) kernfs_put() //     RCU free ext4_notify_error_sysfs(sbi) sysfs_notify(&sbi->s_kobj) kn = kobj->sd // stale pointer     kernfs_get(kn) // UAF on freed kernfs_node ext4_journal_destroy() flush_work(&sbi->s_sb_upd_work) Instead     of reordering the teardown sequence, fix this by making ext4_notify_error_sysfs() detect that sysfs has     already been torn down by checking s_kobj.state_in_sysfs, and skipping the sysfs_notify() call in that     case. A dedicated mutex (s_error_notify_mutex) serializes ext4_notify_error_sysfs() against kobject_del()     in ext4_unregister_sysfs() to prevent TOCTOU races where the kobject could be deleted between the     state_in_sysfs check and the sysfs_notify() call. (CVE-2026-31446)

  - In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Lock all vCPUs when     synchronzing VMSAs for SNP launch finish Lock all vCPUs when synchronizing and encrypting VMSAs for SNP     guests, as allowing userspace to manipulate and/or run a vCPU while its state is being synchronized would     at best corrupt vCPU state, and at worst crash the host kernel. Opportunistically assert that vcpu->mutex     is held when synchronizing its VMSA (the SEV-ES path already locks vCPUs). (CVE-2026-31591)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
377778	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (NVIDIA Tegra) vulnerabilities (USN-8963-1)	Nessus	Ubuntu Local Security Checks	2026/11/9	2026/11/13	high
343048	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500249)	Nessus	Oracle Linux Local Security Checks	2026/9/4	2026/10/21	high
365381	Ubuntu 22.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8877-1)	Nessus	Ubuntu Local Security Checks	2026/10/13	2026/11/13	high
365459	Ubuntu 22.04 LTS : Linux kernel (Azure CVM) vulnerabilities (USN-8876-1)	Nessus	Ubuntu Local Security Checks	2026/10/13	2026/11/13	high
365522	Ubuntu 24.04 LTS : Linux kernel vulnerabilities (USN-8917-1)	Nessus	Ubuntu Local Security Checks	2026/10/14	2026/10/14	medium
374135	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793333110)	Nessus	Alma Linux Local Security Checks	2026/10/30	2026/11/2	high
352548	AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789986443)	Nessus	Alma Linux Local Security Checks	2026/9/30	2026/11/12	high
347900	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:4254-1)	Nessus	SuSE Local Security Checks	2026/9/18	2026/11/13	high
365463	Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)	Nessus	Ubuntu Local Security Checks	2026/10/13	2026/10/13	medium

偵測

搜尋 Plugin

high

high

high

high

medium

high

high

high

medium