Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - ice將 XDP RxQ frag_size 從 DMA 寫入長度變更為 xdp.frame_sz。XDP RxQ 資訊中 frag_size 欄位的唯一使用者是 bpf_xdp_frags_increase_tail()。它顯然會預期完整的緩衝區大小而非 DMA 寫入大小。ice 驅動程式組態中的不同假設導致負的 tailroom。當使用 XDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver 測試並將封包大小變更為 6912 並將要求的位移變更為巨大值 (例如 XSK_UMEM__MAX_FRAME_SIZE * 100) 時允許觸發核心錯誤。由於 ice 中 ZC 組態的其他 quirk 在 ZC 模式下不會觀察到錯誤但 tailroom 成長 (其實並非如此) 時仍會失敗。在 XDP RxQ 資訊中使用填滿佇列緩衝區 truesize而非 DMA 寫入大小。使用新的協助程式也修正 ZC 模式。 (CVE-2026-23377)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - ice将 XDP RxQ frag_size 从 DMA 写入长度更改为 xdp.frame_sz XDP RxQ 信息中 frag_size 字段的唯一用户是 bpf_xdp_frags_increase_tail()。显然需要整个 buff 大小而不是 DMA 写入大小。ice 驱动程序配置中的不同假设导致负 tailroom。当使用 XDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver 测试并将数据包大小更改为 6912并将请求的偏移更改为极大的值例如 XSK_UMEM__MAX_FRAME_SIZE * 100时这允许触发内核错误。由于 ice 中 ZC 配置的其他 quirk在 ZC 模式中未观察到错误但 tailroom 增长在应该不会时仍然会失败。在 XDP RxQ 信息中使用填充队列缓冲区 truesize 而非 DMA 写入大小。通过使用新的帮助程序也修复 ZC 模式。 (CVE-2026-23377)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - iceXDP RxQ frag_size を DMA 書き込み長さから xdp.frame_sz へ変更します XDP RxQ 情報の frag_size フィールドの唯一のユーザーは、bpf_xdp_frags_increase_tail() です。DMA 書き込みサイズの代わりに、バッファ全体のサイズを明確に予期します。ice ドライバー構成での異なる想定が、負の tailroom を引き起こします。これにより、 XDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver テストを使用し、パケットサイズを 6912 に変更し、リクエストされたオフセットを巨大な値、例 XSK_UMEM__MAX_FRAME_SIZE * 100 に変更する際に、カーネルパニックを発生させることが可能です。ice における ZC 構成の他の quirk により、ZC モードでパニックは観察されませんが、tailroom の成長が不適切な場合でも失敗します。XDP RxQ 情報で DMA 書き込みサイズの代わりにフィルキューバッファ truesize を使用します。新しいヘルパーを使用することで ZC モードも修正します。CVE-2026-23377

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    crypto: algif_aead - Revert to operating out-of-place(CVE-2026-31431)

    bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN(CVE-2026-31525)

    can: bcm: fix locking for bcm_op runtime updates(CVE-2026-23362)

    media: mediatek: vcodec: Use spinlock for context list protection lock(CVE-2025-71140)

    smb: client: Don#39;t log plaintext credentials in cifs_set_cifscreds(CVE-2026-23303)

    media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex(CVE-2026-31473)

    regmap: maple: free entry on mas_store_gfp() failure(CVE-2026-23260)

    ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()(CVE-2026-31426)

    apparmor: replace recursive profile removal with iterative approach(CVE-2026-23404)

    tls: Fix race condition in tls_sw_cancel_work_tx()(CVE-2026-23240)

    macvlan: observe an RCU grace period in macvlan_common_newlink() error path(CVE-2026-23273)

    i40e: Fix preempt count leak in napi poll tracepoint(CVE-2026-23313)

    PM: runtime: Fix a race condition related to device removal(CVE-2026-23452)

    net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23381)

    p data-testid='vuln-description'Rejected reason: This CVE ID has been rejected or withdrawn by its     CVE Numbering Authority./pbr/(CVE-2026-23473)

    net: phy: register phy led_triggers during probe to avoid AB-BA deadlock(CVE-2026-23368)

    net: add proper RCU protection to /proc/net/ptype(CVE-2026-23255)

    ice: Fix memory leak in ice_set_ringparam()(CVE-2026-23389)

    ipv6: add NULL checks for idev in SRv6 paths(CVE-2026-23442)

    tracing: Fix potential deadlock in cpu hotplug with osnoise(CVE-2026-31480)

    ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz(CVE-2026-23377)

    tls: Purge async_hold in tls_decrypt_async_wait()(CVE-2026-23414)

    icmp: fix NULL pointer dereference in icmp_tag_validation()(CVE-2026-23398)

    apparmor: fix memory leak in verify_header(CVE-2026-23403)

    x86/efi: defer freeing of boot services memory(CVE-2026-23352)

    netfilter: nf_tables: always walk all pending catchall elements(CVE-2026-23278)

    nvme: fix admin queue leak on controller reset(CVE-2026-23360)

    media: dvb-net: fix OOB access in ULE extension header tables(CVE-2026-31405)

    netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels(CVE-2026-23274)

    net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled(CVE-2026-23293)

    media: dvb-core: fix wrong reinitialization of ringbuffer on reopen(CVE-2026-23253)

    nvme-fc: release admin tagset if init fails(CVE-2026-23261)

    tcp: secure_seq: add back ports to TS offset(CVE-2026-23247)

    KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE(CVE-2026-23401)

    netfilter: bpf: defer hook memory release until rcu readers are done(CVE-2026-23412)

    apparmor: fix missing bounds check on DEFAULT table in verify_dfa()(CVE-2026-23407)

    ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()(CVE-2026-23304)

    ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref(CVE-2026-23145)

    net: gro: fix outer network offset(CVE-2026-23254)

    netfilter: nf_tables: release flowtable after rcu grace period on error(CVE-2026-23392)

    perf: Fix __perf_event_overflow() vs perf_remove_from_context() race(CVE-2026-23271)

    sunrpc: fix cache_request leak in cache_release(CVE-2026-31400)

    RDMA/umad: Reject negative data_len in ib_umad_write(CVE-2026-23243)

    af_unix: Give up GC if MSG_PEEK intervened.(CVE-2026-23394)

    clsact: Fix use-after-free in init/destroy rollback asymmetry(CVE-2026-23413)

    net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop(CVE-2026-23300)

    apparmor: fix unprivileged local user can do privileged policy management(CVE-2026-23268)

    blktrace: fix __this_cpu_read/write in preemptible context(CVE-2026-23374)

    arm64: io: Extract user memory type in ioremap_prot()(CVE-2026-23346)

    xdp: produce a warning when calculated tailroom is negative(CVE-2026-23343)

    mm: thp: deny THP for files on anonymous inodes(CVE-2026-23375)

    drm/vmwgfx: Return the correct value in vmw_translate_ptr functions(CVE-2026-23317)

    netfilter: nft_set_pipapo: split gc into unlink and reclaim phase(CVE-2026-23351)

    Squashfs: check metadata block offset is within range(CVE-2026-23388)

    net: add xmit recursion limit to tunnel xmit functions(CVE-2026-23276)

    net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs(CVE-2026-23340)

    scsi: target: Fix recursive locking in __configfs_open_file()(CVE-2026-23292)

    netfilter: nf_tables: unconditionally bump set-gt;nelems before insertion(CVE-2026-23272)

    apparmor: fix differential encoding verification(CVE-2026-23409)

    dmaengine: idxd: Fix leaking event log memory(CVE-2026-31440)

    bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded(CVE-2026-23310)

    apparmor: fix: limit the number of levels of policy namespaces(CVE-2026-23405)

    net: annotate data-races around sk-gt;sk_{data_ready,write_space}(CVE-2026-23302)

    nfnetlink_osf: validate individual option lengths in fingerprints(CVE-2026-23397)

    erofs: add GFP_NOIO in the bio completion if needed(CVE-2026-31467)

    nvme: fix memory allocation in nvme_pr_read_keys()(CVE-2026-23244)

    arm64: Set __nocfi on swsusp_arch_resume()(CVE-2026-23128)

    nf_tables: nft_dynset: fix possible stateful expression memleak in error path(CVE-2026-23399)

    apparmor: fix side-effect bug in match_char() macro usage(CVE-2026-23406)

    NFSD: Defer sub-object cleanup in export put callbacks(CVE-2026-31404)

    audit: add fchmodat2() to change attributes class(CVE-2025-71239)

    netfilter: xt_CT: drop pending enqueued packets on template removal(CVE-2026-23391)

    bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim(CVE-2026-23319)

    apparmor: validate DFA start states are in bounds in unpack_pdb(CVE-2026-23269)

    bpf: Fix stack-out-of-bounds write in devmap(CVE-2026-23359)

    spi: fix use-after-free on controller registration failure(CVE-2026-31389)

    apparmor: Fix double free of ns_name in aa_replace_profiles()(CVE-2026-23408)

    spi: fix statistics allocation(CVE-2026-23475)

    smb: client: fix krb5 mount with username option(CVE-2026-31392)

    NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd(CVE-2026-31403)

    apparmor: fix race between freeing data and fs accessing it(CVE-2026-23411)

    apparmor: fix race on rawdata dereference(CVE-2026-23410)

    sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting(CVE-2026-23371)

    dmaengine: idxd: Fix memory leak when a wq is reset(CVE-2026-31441)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz The only user of frag_size field in     XDP RxQ info is bpf_xdp_frags_increase_tail(). It clearly expects whole buff size instead of DMA write     size. Different assumptions in ice driver configuration lead to negative tailroom. This allows to trigger     kernel panic, when using XDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet size to 6912     and the requested offset to a huge value, e.g. XSK_UMEM__MAX_FRAME_SIZE * 100. Due to other quirks of the     ZC configuration in ice, panic is not observed in ZC mode, but tailroom growing still fails when it should     not. Use fill queue buffer truesize instead of DMA write size in XDP RxQ info. Fix ZC mode too by using     the new helper. (CVE-2026-23377)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
303705	Linux Distros 未修補的弱點：CVE-2026-23377	Nessus	Misc.	2026/3/25	2026/7/25	medium
303705	Linux Distros 未修补的漏洞：CVE-2026-23377	Nessus	Misc.	2026/3/25	2026/7/25	medium
303705	Linux Distros のパッチ未適用の脆弱性: CVE-2026-23377	Nessus	Misc.	2026/3/25	2026/7/25	medium
323152	EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-2444)	Nessus	Huawei Local Security Checks	2026/6/27	2026/6/29	high
323212	EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-2485)	Nessus	Huawei Local Security Checks	2026/6/27	2026/6/29	high
303705	Linux Distros Unpatched Vulnerability : CVE-2026-23377	Nessus	Misc.	2026/3/25	2026/7/25	medium

偵測

搜尋 Plugin

medium

medium

medium

high

high

medium