The remote Ubuntu 22.04 LTS / 24.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8802-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM32 architecture;

    - ARM64 architecture;

    - PowerPC architecture;

    - Compute Acceleration Framework;

    - Drivers core;

    - Bluetooth drivers;

    - Arm Firmware Framework for ARMv8-A(FFA);

    - EFI core;

    - GPU drivers;

    - Hardware monitoring drivers;

    - InfiniBand drivers;

    - Network drivers;

    - Microsoft Azure Network Adapter (MANA) driver;

    - SCSI subsystem;

    - SPI subsystem;

    - Network file systems library;

    - NTFS3 file system;

    - SMB network file system;

    - File systems infrastructure;

    - Software nodes and device properties;

    - Bluetooth subsystem;

    - Netfilter;

    - Tracing infrastructure;

    - io_uring subsystem;

    - IRQ subsystem;

    - KProbes tracing;

    - Memory management;

    - B.A.T.M.A.N. meshing protocol;

    - Ethernet bridge;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - Multipath TCP;

    - Phonet protocol;

    - SMC sockets;

    - TLS protocol;

    - Unix domain sockets;

    - VMware vSockets driver;

    - Wireless networking;

    - Key management;

    - Linux Security Modules (LSM) Framework;

    - ALSA framework;

    - AudioScience HPI driver; (CVE-2025-71289, CVE-2026-23469, CVE-2026-31420, CVE-2026-31486,     CVE-2026-31506, CVE-2026-31560, CVE-2026-46158, CVE-2026-46170, CVE-2026-46275, CVE-2026-46315,     CVE-2026-52912, CVE-2026-52915, CVE-2026-52916, CVE-2026-52918, CVE-2026-52919, CVE-2026-52921,     CVE-2026-52922, CVE-2026-52926, CVE-2026-52941, CVE-2026-53357, CVE-2026-64015, CVE-2026-64018,     CVE-2026-64025, CVE-2026-64029, CVE-2026-64032, CVE-2026-64033, CVE-2026-64034, CVE-2026-64039,     CVE-2026-64046, CVE-2026-64047, CVE-2026-64048, CVE-2026-64051, CVE-2026-64055, CVE-2026-64056,     CVE-2026-64064, CVE-2026-64073, CVE-2026-64083, CVE-2026-64084, CVE-2026-64085, CVE-2026-64086,     CVE-2026-64087, CVE-2026-64088, CVE-2026-64089, CVE-2026-64092, CVE-2026-64096, CVE-2026-64097,     CVE-2026-64098, CVE-2026-64102, CVE-2026-64103, CVE-2026-64106, CVE-2026-64108, CVE-2026-64109,     CVE-2026-64111, CVE-2026-64113, CVE-2026-64114, CVE-2026-64115, CVE-2026-64116, CVE-2026-64118,     CVE-2026-64121, CVE-2026-64125, CVE-2026-64126, CVE-2026-64127, CVE-2026-64128, CVE-2026-64133,     CVE-2026-64134, CVE-2026-64135, CVE-2026-64136, CVE-2026-64137, CVE-2026-64138, CVE-2026-64144,     CVE-2026-64147, CVE-2026-64148, CVE-2026-64153, CVE-2026-64155, CVE-2026-64163, CVE-2026-64165,     CVE-2026-64166, CVE-2026-64168, CVE-2026-64170, CVE-2026-64173, CVE-2026-64174, CVE-2026-64177,     CVE-2026-64178, CVE-2026-64179, CVE-2026-64180, CVE-2026-64182, CVE-2026-64183, CVE-2026-64184,     CVE-2026-64185, CVE-2026-64214, CVE-2026-64217, CVE-2026-64218, CVE-2026-64219, CVE-2026-64220,     CVE-2026-64221, CVE-2026-64225, CVE-2026-64231, CVE-2026-64518)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63013 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: s390/cpum_sf: Handle CPU hotplug remove during sampling (CVE-2024-57849)

    * kernel: smc91x: fix broken irq-context in PREEMPT_RT (CVE-2025-71132)

    * kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)

    * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)

    * kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)

    * kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)

    * kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)

    * kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)

    * kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)

    * kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)

    * kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)

    * kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)

    * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)

    * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)

    Bug Fix(es) and Enhancement(s):

    * qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [rhel-8.10.z]     (JIRA:RHEL-193045)

    * powerpc/pseries: lparcfg - fix kbuf[] underflow (JIRA:RHEL-240144)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1815:78 advisory.

    * kernel: s390/cpum_sf: Handle CPU hotplug remove during sampling (CVE-2024-57849)
      * kernel: smc91x: fix broken irq-context in PREEMPT_RT (CVE-2025-71132)
      * kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)
      * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)
      * kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)
      * kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)
      * kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)
      * kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)
      * kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)
      * kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)
      * kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)
      * kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)
      * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)
      * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:61887 advisory.

    * kernel: seccomp: passthrough uretprobe systemcall without filtering (CVE-2025-21834)
      * kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)
      * kernel: netfilter: nf_tables: Fix for duplicate device in netdev hooks (CVE-2026-43454)
      * kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)
      * kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)
      * kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120)
      * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)
      * kernel: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CVE-2026-53026)
      * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)
      * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)
      * kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189)
      * kernel: mm/list_lru: drain before clearing xarray entry on reparent (CVE-2026-53153)
      * kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)
      * kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)
      * kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)
      * kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)
      * kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)
      * kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)
      * kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136)
      * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)
      * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)
      * kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438)
      * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304)
      * kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)
      * kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490)
      * kernel: mm: shrinker: fix shrinker_info teardown race with expansion (CVE-2026-64418)
      * kernel: smb: client: fix change notify replay double-free (CVE-2026-64384)
      * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)
      * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)
      * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)
      * kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086)
      * kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation     (CVE-2026-68166)
      * kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069)
      * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130)
      * kernel: ceph: give up on paths longer than PATH_MAX (CVE-2024-53685)
      * kernel: ceph: fix memory leaks in ceph_mdsc_build_path() (CVE-2026-43419)
      * kernel: ceph: add a bunch of missing ceph_path_info initializers (CVE-2026-43408)


    Bug Fix(es) and Enhancement(s):

      * AlmaLinux 10: s390: Revert support for DCACHE_WORD_ACCESS [almalinux-10.2.z] (JIRA:AlmaLinux-188180)
      * qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [almalinux-10.2.z]     (JIRA:AlmaLinux-193043)
      * ss core dumped when there is an SCTP session [almalinux-10.2.z] (JIRA:AlmaLinux-212393)
      * [AlmaLinux-10.2.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:AlmaLinux-218627)
      * AlmaLinux10.0 - s390/pfault: Fix virtual vs physical address confusion [almalinux-10.2.z]     (JIRA:AlmaLinux-222507)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_61887 advisory.

    * kernel: seccomp: passthrough uretprobe systemcall without filtering (CVE-2025-21834)

    * kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)

    * kernel: netfilter: nf_tables: Fix for duplicate device in netdev hooks (CVE-2026-43454)

    * kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)

    * kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)

    * kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120)

    * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)

    * kernel: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CVE-2026-53026)

    * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)

    * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

    * kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189)

    * kernel: mm/list_lru: drain before clearing xarray entry on reparent (CVE-2026-53153)

    * kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)

    * kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)

    * kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)

    * kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)

    * kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)

    * kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)

    * kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136)

    * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)

    * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)

    * kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438)

    * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304)

    * kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)

    * kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490)

    * kernel: mm: shrinker: fix shrinker_info teardown race with expansion (CVE-2026-64418)

    * kernel: smb: client: fix change notify replay double-free (CVE-2026-64384)

    * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)

    * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)

    * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)

    * kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086)

    * kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation     (CVE-2026-68166)

    * kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069)

    * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130)

    Bug Fix(es) and Enhancement(s):

    * Rocky Linux 10: s390: Revert support for DCACHE_WORD_ACCESS [rhel-10.2.z] (JIRA:Rocky Linux-188180)

    * qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [rhel-10.2.z] (JIRA:Rocky     Linux-193043)

    * ss core dumped when there is an SCTP session [rhel-10.2.z] (JIRA:Rocky Linux-212393)

    * [Rocky Linux-10.2.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:Rocky Linux-218627)

    * Rocky Linux10.0 - s390/pfault: Fix virtual vs physical address confusion [rhel-10.2.z] (JIRA:Rocky     Linux-222507)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4369-1 advisory.

    The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues:

    The following security issues were fixed:

    - CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731).
    - CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
    - CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
    - CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
    - CVE-2026-43147: Revert 'PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV'     (bsc#1264642).
    - CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).
    - CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
    - CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period (bsc#1268659).
    - CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
    - CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
    - CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
    - CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
    - CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
    - CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985).
    - CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).
    - CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).
    - CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).
    - CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).
    - CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).
    - CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).
    - CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).
    - CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).
    - CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
    - CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).
    - CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()     (bsc#1272390).
    - CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).
    - CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662).
    - CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).
    - CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).
    - CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).
    - CVE-2026-64002: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()     (bsc#1273774).
    - CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).
    - CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).
    - CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).
    - CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).
    - CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766).
    - CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).
    - CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).
    - CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).
    - CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273742).
    - CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).
    - CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273743).
    - CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272798).
    - CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).
    - CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).
    - CVE-2026-64312: crypto: pcrypt - restore callback for non-parallel fallback (bsc#1273968).
    - CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).
    - CVE-2026-64383: smb: client: fix double-free in SMB2_flush() replay (bsc#1273426).
    - CVE-2026-64384: smb: client: fix change notify replay double-free (bsc#1274541).
    - CVE-2026-64385: smb: client: fix double-free in SMB2_ioctl() replay (bsc#1274539).
    - CVE-2026-64386: smb: client: fix query_info() replay double-free (bsc#1274543).
    - CVE-2026-64387: smb: client: fix query directory replay double-free (bsc#1274545).
    - CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).
    - CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).
    - CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).
    - CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).
    - CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).
    - CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).
    - CVE-2026-64563: rhashtable: clear stale iter->p on table restart (bsc#1273995).
    - CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (bsc#1274014).
    - CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (bsc#1274031).
    - CVE-2026-64581: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (bsc#1274041).
    - CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).
    - CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1274888).
    - CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs (bsc#1275474).
    - CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274941).
    - CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).
    - CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).
    - CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).
    - CVE-2026-68160: ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (bsc#1275472).
    - CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275161).
    - CVE-2026-68397: net/iucv: take a reference on the socket found in afiucv_hs_rcv() (bsc#1274898).
    - CVE-2026-68398: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (bsc#1274908).
    - CVE-2026-68417: RDMA/siw: publish QP after initialization (bsc#1274696).
    - CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274705).
    - CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection (bsc#1274208).
    - CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (bsc#1275506).
    - CVE-2026-72069: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (bsc#1275528).
    - CVE-2026-72072: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (bsc#1277155).
    - CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).
    - CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).
    - CVE-2026-72123: can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (bsc#1277523).
    - CVE-2026-72135: tpm: Make the TPM character devices non-seekable (bsc#1277571).
    - CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (bsc#1275665).
    - CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (bsc#1275669).
    - CVE-2026-72251: netfilter: nf_nat_sip: reload possible stale data pointer (bsc#1275827).
    - CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277678).
    - CVE-2026-72288: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling     (bsc#1275886).
    - CVE-2026-72289: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (bsc#1275905).
    - CVE-2026-72317: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (bsc#1275925).
    - CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).
    - CVE-2026-72389: bridge: stp: Fix a potential use-after-free when deleting a bridge (bsc#1273869).
    - CVE-2026-74345: RDMA/siw: Fix endpoint/socket association handling (bsc#1277285).
    - CVE-2026-74377: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path (bsc#1278236).
    - CVE-2026-74378: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (bsc#1278233).
    - CVE-2026-74390: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs (bsc#1278088).
    - CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277408).
    - CVE-2026-74454: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO (bsc#1277073).
    - CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (bsc#1276350).
    - CVE-2026-74496: fou: Fix use-after-free in fou_create() (bsc#1275867).
    - CVE-2026-74516: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active     (bsc#1275797).
    - CVE-2026-74518: mm/hugetlb: fix list corruption in allocate_file_region_entries() (bsc#1275798).
    - CVE-2026-74537: Bluetooth: ISO: hold sk properly in iso_conn_ready (bsc#1275687).
    - CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer     (bsc#1275696).
    - CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result (bsc#1275782).
    - CVE-2026-74582: packet: use consistent hard_header_len in non-ring send paths (bsc#1275784).
    - CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277505).
    - CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277391).
    - CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()     (bsc#1276931).
    - CVE-2026-80722: wifi: mac80211: validate individual TWT params before driver setup (bsc#1277860).

    The following non security issues were fixed:

    - ibmvnic: Only record tx completed bytes once per handler (bsc#1274620).
    - KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value (git-fixes).
    - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page (git-fixes).
    - mkspec-dtb: Move DTS prefix into package list.
    - mkspec-dtb: Move provides-obsoletes to package list.
    - mkspec-dtb: Put per-architecture package lists into a hash.
    - mkspec-dtb: re-indent.
    - net: mana: Add debug knob to skip TX timeout recovery reset (git-fixes).
    - net: mana: Add handler for sriov configure (bsc#1272756).
    - net: mana: Cap MSI-X vectors to the device MSI-X table size (git-fixes).
    - net: mana: Extend RX CQE coalescing up to 8 packets (git-fixes).
    - net: mana: Fall back to scattered pages for GDMA queues (git-fixes).
    - net: mana: force full-page RX buffers via ethtool private flag (bsc#1269792).
    - net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch (bsc#1269792).
    - net: mana: Route ring-buffer access through offset-based helpers (git-fixes).
    - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (git-fixes bsc#1274550).
    - PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip (git-fixes).
    - powerpc/pseries: lparcfg - fix kbuf[] underflow (bsc#1274753 ltc#221289 bsc#1274754 ltc#221288     bsc#1274752       ltc#221290).
    - RDMA/mana_ib: drain QP references after partial table insertion (git-fixes).
    - RDMA/mana_ib: unify QP lookup table (git-fixes).
    - scsi: storvsc: Support manual scans for all Hyper-V targets (git-fixes).
    - smb/client: handle overlapping allocated ranges in fallocate (bsc#1274902).
    - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791800936 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: mptcp: fix 'scheduling while atomic'     in mptcp_pm_nl_append_new_local_addr If multiple connection requests attempt to create an implicit mptcp     endpoint in parallel, more than one caller may end up in mptcp_pm_nl_append_new_local_addr because none     found the address in local_addr_list during their call to mptcp_pm_nl_get_local_id. In this case, the     concurrent new_local_addr calls may delete the address entry created by the previous caller. These deletes     use synchronize_rcu, but this is not permitted in some of the contexts where this function may be called.
    During packet recv, the caller may be in a rcu read critical section and have preemption disabled. An     example stack: BUG: scheduling while atomic: swapper/2/0/0x00000302 Call Trace: <IRQ> dump_stack_lvl     (lib/dump_stack.c:117 (discriminator 1)) dump_stack (lib/dump_stack.c:124) __schedule_bug     (kernel/sched/core.c:5943) schedule_debug.constprop.0 (arch/x86/include/asm/preempt.h:33     kernel/sched/core.c:5970) __schedule (arch/x86/include/asm/jump_label.h:27 include/linux/jump_label.h:207     kernel/sched/features.h:29 kernel/sched/core.c:6621) schedule (arch/x86/include/asm/preempt.h:84     kernel/sched/core.c:6804 kernel/sched/core.c:6818) schedule_timeout (kernel/time/timer.c:2160)     wait_for_completion (kernel/sched/completion.c:96 kernel/sched/completion.c:116     kernel/sched/completion.c:127 kernel/sched/completion.c:148) __wait_rcu_gp (include/linux/rcupdate.h:311     kernel/rcu/update.c:444) synchronize_rcu (kernel/rcu/tree.c:3609) mptcp_pm_nl_append_new_local_addr     (net/mptcp/pm_netlink.c:966 net/mptcp/pm_netlink.c:1061) mptcp_pm_nl_get_local_id     (net/mptcp/pm_netlink.c:1164) mptcp_pm_get_local_id (net/mptcp/pm.c:420) subflow_check_req     (net/mptcp/subflow.c:98 net/mptcp/subflow.c:213) subflow_v4_route_req (net/mptcp/subflow.c:305)     tcp_conn_request (net/ipv4/tcp_input.c:7216) subflow_v4_conn_request (net/mptcp/subflow.c:651)     tcp_rcv_state_process (net/ipv4/tcp_input.c:6709) tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1934) tcp_v4_rcv     (net/ipv4/tcp_ipv4.c:2334) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205 (discriminator 1))     ip_local_deliver_finish (include/linux/rcupdate.h:813 net/ipv4/ip_input.c:234) ip_local_deliver     (include/linux/netfilter.h:314 include/linux/netfilter.h:308 net/ipv4/ip_input.c:254)     ip_sublist_rcv_finish (include/net/dst.h:461 net/ipv4/ip_input.c:580) ip_sublist_rcv     (net/ipv4/ip_input.c:640) ip_list_rcv (net/ipv4/ip_input.c:675) __netif_receive_skb_list_core     (net/core/dev.c:5583 net/core/dev.c:5631) netif_receive_skb_list_internal (net/core/dev.c:5685     net/core/dev.c:5774) napi_complete_done (include/linux/list.h:37 include/net/gro.h:449     include/net/gro.h:444 net/core/dev.c:6114) igb_poll (drivers/net/ethernet/intel/igb/igb_main.c:8244) igb
    __napi_poll (net/core/dev.c:6582) net_rx_action (net/core/dev.c:6653 net/core/dev.c:6787) handle_softirqs     (kernel/softirq.c:553) __irq_exit_rcu (kernel/softirq.c:588 kernel/softirq.c:427 kernel/softirq.c:636)     irq_exit_rcu (kernel/softirq.c:651) common_interrupt (arch/x86/kernel/irq.c:247 (discriminator 14)) </IRQ>     This problem seems particularly prevalent if the user advertises an endpoint that has a different external     vs internal address. In the case where the external address is advertised and multiple connections already     exist, multiple subflow SYNs arrive in parallel which tends to trigger the race during creation of the     first local_addr_list entries which have the internal address instead. Fix by skipping the replacement of     an existing implicit local address if called via mptcp_pm_nl_get_local_id. (CVE-2025-21938)

  - In the Linux kernel, the following vulnerability has been resolved: mm/debug_vm_pgtable: clear page table     entries at destroy_args() The mm/debug_vm_pagetable test allocates manually page table entries for the     tests it runs, using also its manually allocated mm_struct. That in itself is ok, but when it exits, at     destroy_args() it fails to clear those entries with the *_clear functions. The problem is that leaves     stale entries. If another process allocates an mm_struct with a pgd at the same address, it may end up     running into the stale entry. This is happening in practice on a debug kernel with     CONFIG_DEBUG_VM_PGTABLE=y, for example this is the output with some extra debugging I added (it prints a     warning trace if pgtables_bytes goes negative, in addition to the warning at check_mm() function): [     2.539353] debug_vm_pgtable: [get_random_vaddr ]: random_vaddr is 0x7ea247140000 [ 2.539366] kmem_cache     info [ 2.539374] kmem_cachep 0x000000002ce82385 - freelist 0x0000000000000000 - offset 0x508 [ 2.539447]     debug_vm_pgtable: [init_args ]: args->mm is 0x000000002267cc9e (...) [ 2.552800] WARNING: CPU: 5 PID: 116     at include/linux/mm.h:2841 free_pud_range+0x8bc/0x8d0 [ 2.552816] Modules linked in: [ 2.552843] CPU: 5     UID: 0 PID: 116 Comm: modprobe Not tainted 6.12.0-105.debug_vm2.el10.ppc64le+debug #1 VOLUNTARY [     2.552859] Hardware name: IBM,9009-41A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW910.00 (VL910_062)     hv:phyp pSeries [ 2.552872] NIP: c0000000007eef3c LR: c0000000007eef30 CTR: c0000000003d8c90 [ 2.552885]     REGS: c0000000622e73b0 TRAP: 0700 Not tainted (6.12.0-105.debug_vm2.el10.ppc64le+debug) [ 2.552899] MSR:
    800000000282b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 24002822 XER: 0000000a [ 2.552954] CFAR:
    c0000000008f03f0 IRQMASK: 0 [ 2.552954] GPR00: c0000000007eef30 c0000000622e7650 c000000002b1ac00     0000000000000001 [ 2.552954] GPR04: 0000000000000008 0000000000000000 c0000000007eef30 ffffffffffffffff [     2.552954] GPR08: 00000000ffff00f5 0000000000000001 0000000000000048 0000000000004000 [ 2.552954] GPR12:
    00000003fa440000 c000000017ffa300 c0000000051d9f80 ffffffffffffffdb [ 2.552954] GPR16: 0000000000000000     0000000000000008 000000000000000a 60000000000000e0 [ 2.552954] GPR20: 4080000000000000 c0000000113af038     00007fffcf130000 0000700000000000 [ 2.552954] GPR24: c000000062a6a000 0000000000000001 8000000062a68000     0000000000000001 [ 2.552954] GPR28: 000000000000000a c000000062ebc600 0000000000002000 c000000062ebc760 [     2.553170] NIP [c0000000007eef3c] free_pud_range+0x8bc/0x8d0 [ 2.553185] LR [c0000000007eef30]     free_pud_range+0x8b0/0x8d0 [ 2.553199] Call Trace: [ 2.553207] [c0000000622e7650] [c0000000007eef30]     free_pud_range+0x8b0/0x8d0 (unreliable) [ 2.553229] [c0000000622e7750] [c0000000007f40b4]     free_pgd_range+0x284/0x3b0 [ 2.553248] [c0000000622e7800] [c0000000007f4630] free_pgtables+0x450/0x570 [     2.553274] [c0000000622e78e0] [c0000000008161c0] exit_mmap+0x250/0x650 [ 2.553292] [c0000000622e7a30]     [c0000000001b95b8] __mmput+0x98/0x290 [ 2.558344] [c0000000622e7a80] [c0000000001d1018]     exit_mm+0x118/0x1b0 [ 2.558361] [c0000000622e7ac0] [c0000000001d141c] do_exit+0x2ec/0x870 [ 2.558376]     [c0000000622e7b60] [c0000000001d1ca8] do_group_exit+0x88/0x150 [ 2.558391] [c0000000622e7bb0]     [c0000000001d1db8] sys_exit_group+0x48/0x50 [ 2.558407] [c0000000622e7be0] [c00000000003d810]     system_call_exception+0x1e0/0x4c0 [ 2.558423] [c0000000622e7e50] [c00000000000d05c]     system_call_vectored_common+0x15c/0x2ec (...) [ 2.558892] ---[ end trace 0000000000000000 ]--- [ 2.559022]     BUG: Bad rss-counter state mm:000000002267cc9e type:MM_ANONPAGES val:1 [ 2.559037] BUG: non-zero     pgtables_bytes on freeing mm: -6144 Here the modprobe process ended up with an allocated mm_struct from     the mm_struct slab that was used before by the debug_vm_pgtable test. That is not a problem, since the     mm_stru ---truncated--- (CVE-2025-39776)

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header     before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset     types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an     Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between     `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet     device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing     `eth_hdr(skb)`. (CVE-2026-53131)

  - In the Linux kernel, the following vulnerability has been resolved: kernfs: Relax constraint in draining     guard The active reference lifecycle provides the break/unbreak mechanism but the active reference is not     truly active after unbreak -- callers don't use it afterwards but it's important for proper pairing of     kn->active counting. Assuming this mechanism is in place, the WARN check in     kernfs_should_drain_open_files() is too sensitive -- it may transiently catch those (rightful) callers     between kernfs_unbreak_active_protection() and kernfs_put_active() as found out by Chen Ridong:
    kernfs_remove_by_name_ns kernfs_get_active // active=1 __kernfs_remove // active=0x80000002 kernfs_drain     ... wait_event //waiting (active == 0x80000001) kernfs_break_active_protection // active = 0x80000001 //     continue kernfs_unbreak_active_protection // active = 0x80000002 ... kernfs_should_drain_open_files //     warning occurs kernfs_put_active To avoid the false positives (mind panic_on_warn) remove the check     altogether. (This is meant as quick fix, I think active reference break/unbreak may be simplified with     larger rework.) (CVE-2025-38282)

  - In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of     MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and     filtering out EINPROGRESS notifications. (CVE-2026-43493)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1792750763 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between     dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read     inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw() of the array pointer. These run     from netlink_recvmsg() without the nfnl mutex and without an RCU read-side critical section. A concurrent     ip_set_create() can grow the array: it publishes the new array, calls synchronize_net() and then kvfree()s     the old one. Since the dump paths read the array outside any RCU reader, synchronize_net() does not wait     for them and the old array can be freed while they still index into it, causing a use-after-free. The     dumped set itself stays pinned via set->ref_netlink, so only the array load needs protecting. Take     rcu_read_lock() around it, matching ip_set_get_byname() and __ip_set_put_byindex(). BUG: KASAN: slab-use-     after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) Read of size 8 at addr     ffff88800b5c4018 by task exploit/150 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip_set_dump_do     (net/netfilter/ipset/ip_set_core.c:1697) netlink_dump (net/netlink/af_netlink.c:2325) netlink_recvmsg     (net/netlink/af_netlink.c:1976) sock_recvmsg (net/socket.c:1159) __sys_recvfrom (net/socket.c:2315) ...
    Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI KASAN: maybe wild-     memory-access in range [0x02d6...d0-0x02d6...d7] RIP: 0010:ip_set_dump_do     (net/netfilter/ipset/ip_set_core.c:1698) Kernel panic - not syncing: Fatal exception (CVE-2026-64189)

  - In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to     region_count overflow The local variable region_count in create_log_context() is declared as unsigned int     (32-bit), but dm_sector_div_up() returns sector_t (64-bit). When a device-mapper target has a sufficiently     large ti->len with a small region_size, the division result can exceed UINT_MAX. The truncated value is     then used to calculate bitset_size, causing clean_bits, sync_bits, and recovering_bits to be allocated far     smaller than needed for the actual number of regions. Subsequent log operations (log_set_bit,     log_clear_bit, log_test_bit) use region indices derived from the full untruncated region space, causing     out-of-bounds writes to kernel heap memory allocated by vmalloc. This can be reproduced by creating a     mirror target whose region_count overflows 32 bits: dmsetup create bigzero --table '0 8589934594 zero'     dmsetup create mymirror --table '0 8589934594 mirror \ core 2 2 nosync 2 /dev/mapper/bigzero 0 \     /dev/mapper/bigzero 0' The status output confirms the truncation (sync_count=1 instead of 4294967297,     because 0x100000001 was truncated to 1): $ dmsetup status mymirror 0 8589934594 mirror 2 254:1 254:1     1/4294967297 ... This leads to a kernel crash in core_in_sync: BUG: scheduling while atomic: (udev-     worker)/9150/0x00000000 RIP: 0010:core_in_sync+0x14/0x30 [dm_log] CR2: 0000000000000008 Fixing recursive     fault but reboot is needed! Fix by widening the local region_count to sector_t and adding an explicit     overflow check before the value is assigned to lc->region_count. (CVE-2026-53059)

  - In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop     ipv6_route_iter_active() treats a walker in FWS_U at the table root as already unlinked. fib6_del_route()     can move a still-linked walker into that same state when the current leaf is the last route at the root,     so ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq private object can then be freed while     it remains on net->ipv6.fib6_walkers. A later route deletion walks the dangling list and uses the freed     walker. Use the list head as membership state and reinitialize it when unlinking. Keep the existing     w->node check so a never-started iterator with a zeroed private object is not treated as linked. The same     stop helper is used by /proc/net/ipv6_route and by the BPF ipv6_route iterator. The BPF show path only     widens the race. (CVE-2026-97940)

  - In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after     deleting a port group br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave     path. After br_multicast_del_pg() removes p, continuing the loop advances pp through the deleted entry. If     multicast-to-unicast was enabled, the bridge can hold multiple port groups for the same port and group     with different source MAC addresses. Once multicast-to-unicast is disabled, br_port_group_equal() matches     those entries by port only. A fast leave can then delete one entry and continue from its stale next     pointer, leaving mp->ports pointing at a deleted port group. Fast leave only needs to remove one matching     port group. Break after br_multicast_del_pg() so the loop stops before dereferencing the removed entry.
    (CVE-2026-74480)

  - In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free     In dma_release_channel(), check chan->device->privatecnt after call dma_chan_put(). However,     dma_chan_put() call dma_device_put() which could release the last reference of the device if the DMA     provider is already gone and hence free it. Fixes it by moving dma_chan_put() after the check.
    (CVE-2026-72476)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
349264	Ubuntu 22.04 LTS / 24.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (Oracle) vulnerabilities (USN-8802-1)	Nessus	Ubuntu Local Security Checks	2026/9/23	2026/11/11	high
343532	Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8728-1)	Nessus	Ubuntu Local Security Checks	2026/9/7	2026/11/14	high
342569	RHEL 8 : kernel-rt (RHSA-2026:63013)	Nessus	Red Hat Local Security Checks	2026/9/3	2026/9/3	high
345590	MiracleLinux 8 : kernel-4.18.0-553.159.1.el8_10 (AXSA:2026-1815:78)	Nessus	Miracle Linux Local Security Checks	2026/9/14	2026/9/14	high
333944	Photon OS 5.0: Linux PHSA-2026-5.0-92-0864	Nessus	PhotonOS Local Security Checks	2026/8/10	2026/11/3	high
343087	AlmaLinux 10 : kernel (ALSA-2026:61887)	Nessus	Alma Linux Local Security Checks	2026/9/5	2026/9/5	high
353512	Rocky Linux 10 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_61887)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
350940	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4369-1)	Nessus	SuSE Local Security Checks	2026/9/29	2026/10/5	high
364689	AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791800936)	Nessus	Alma Linux Local Security Checks	2026/10/12	2026/11/13	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	2026/8/26	2026/11/11	high
347900	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:4254-1)	Nessus	SuSE Local Security Checks	2026/9/18	2026/11/13	high
371224	CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1792750763)	Nessus	CentOS Local Security Checks	2026/10/23	2026/11/12	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high