AlmaLinux 9.2 主機已安裝的套件會受到 TuxCare ALMALINUX9.2：CLSA-2026：1792243434 公告中提及的多個弱點影響。

  - 已解決 Linux 核心中的下列弱點：ethernet: hisilicon: hns:
    hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() The if statement: if (port >= DSAF_GE_NUM) return; limits the value of port less than DSAF_GE_NUM (i.e., 8). However, if the value of port is 6 or 7, an array overflow could occur: port_rst_off = dsaf_dev->mac_cb[port]->port_rst_off;
    because the length of dsaf_dev->mac_cb is DSAF_MAX_PORT_NUM (i.e., 6). To fix this possible array overflow, we first check port and if it is greater than or equal to DSAF_MAX_PORT_NUM, the function returns. (CVE-2021-47548)

  - 已解決 Linux 核心中的下列弱點：SUNRPC: Fix a suspicious RCU usage warning I received the following warning while running cthon against an ontap server running pNFS: [57.202521] ============================= [ 57.202522] WARNING: suspicious RCU usage [ 57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted [ 57.202525] ----------------------------- [ 57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!! [ 57.202527] other info that might help us debug this: [ 57.202528] rcu_scheduler_active = 2, debug_locks = 1 [ 57.202529] no locks held by test5/3567. [ 57.202530] stack backtrace: [ 57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e [ 57.202534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022 [ 57.202536] Call Trace: [ 57.202537] <TASK> [57.202540] dump_stack_lvl+0x77/0xb0 [ 57.202551] lockdep_rcu_suspicious+0x154/0x1a0 [ 57.202556] rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202596] rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202621] ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202646] rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202671] ?
    __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [57.202696] nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202728] ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202754] nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a] [57.202760] filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a] [ 57.202765] pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202788] __nfs_pageio_add_request+0x3fd/0x520 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202813] nfs_pageio_add_request+0x18b/0x390 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202831] nfs_do_writepage+0x116/0x1e0 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202849] nfs_writepages_callback+0x13/0x30 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202866] write_cache_pages+0x265/0x450 [ 57.202870] ?
    __pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202891] nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202913] do_writepages+0xd2/0x230 [ 57.202917] ? filemap_fdatawrite_wbc+0x5c/0x80 [ 57.202921] filemap_fdatawrite_wbc+0x67/0x80 [ 57.202924] filemap_write_and_wait_range+0xd9/0x170 [ 57.202930] nfs_wb_all+0x49/0x180 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202947] nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202969]
    __se_sys_close+0x46/0xd0 [ 57.202972] do_syscall_64+0x68/0x100 [ 57.202975] ? do_syscall_64+0x77/0x100 [57.202976] ? do_syscall_64+0x77/0x100 [ 57.202979] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 57.202982] RIP: 0033:0x7fe2b12e4a94 [ 57.202985] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83 ec 18 89 7c 24 0c e8 c3 [ 57.202987] RSP: 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX:
    0000000000000003 [ 57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94 [57.202991] RDX: 0000000000002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003 [ 57.202992] RBP:
    00007ffe857dfc50 R08: 7fffffffffffffff R09: 0000000065650f49 [ 57.202993] R10: 00007f ---truncated--- (CVE-2023-52623)

  - 已解決 Linux 核心中的下列弱點：dm: call the resume method on internal suspend There is this reported crash when experimenting with the lvm2 testsuite. The list corruption is caused by the fact that the postsuspend and resume methods were not paired correctly; there were two consecutive calls to the origin_postsuspend function. The second call attempts to remove the hash_list entry from a list, while it was already removed by the first call. Fix __dm_internal_resume so that it calls the preresume and resume methods of the table's targets. If a preresume method of some target fails, we are in a tricky situation. We can't return an error because dm_internal_resume isn't supposed to return errors. We can't return success, because then the resume and postsuspend methods would not be paired correctly. So, we set the DMF_SUSPENDED flag and we fake normal suspend - it may confuse userspace tools, but it won't cause a kernel crash. ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:56! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 1 PID: 8343 Comm: dmsetup Not tainted 6.8.0-rc6 #4 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 RIP:
    0010:__list_del_entry_valid_or_report+0x77/0xc0 <snip> RSP: 0018:ffff8881b831bcc0 EFLAGS: 00010282 RAX:
    000000000000004e RBX: ffff888143b6eb80 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffffffff819053d0 RDI: 00000000ffffffff RBP: ffff8881b83a3400 R08: 00000000fffeffff R09: 0000000000000058 R10:
    0000000000000000 R11: ffffffff81a24080 R12: 0000000000000001 R13: ffff88814538e000 R14: ffff888143bc6dc0 R15: ffffffffa02e4bb0 FS: 00000000f7c0f780(0000) GS:ffff8893f0a40000(0000) knlGS:0000000000000000 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 0000000057fb5000 CR3: 0000000143474000 CR4: 00000000000006b0 Call Trace: <TASK> ? die+0x2d/0x80 ? do_trap+0xeb/0xf0 ? __list_del_entry_valid_or_report+0x77/0xc0 ? do_error_trap+0x60/0x80 ? __list_del_entry_valid_or_report+0x77/0xc0 ? exc_invalid_op+0x49/0x60 ?
    __list_del_entry_valid_or_report+0x77/0xc0 ? asm_exc_invalid_op+0x16/0x20 ? table_deps+0x1b0/0x1b0 [dm_mod] ? __list_del_entry_valid_or_report+0x77/0xc0 origin_postsuspend+0x1a/0x50 [dm_snapshot] dm_table_postsuspend_targets+0x34/0x50 [dm_mod] dm_suspend+0xd8/0xf0 [dm_mod] dev_suspend+0x1f2/0x2f0 [dm_mod] ? table_deps+0x1b0/0x1b0 [dm_mod] ctl_ioctl+0x300/0x5f0 [dm_mod] dm_compat_ctl_ioctl+0x7/0x10 [dm_mod] __x64_compat_sys_ioctl+0x104/0x170 do_syscall_64+0x184/0x1b0 entry_SYSCALL_64_after_hwframe+0x46/0x4e RIP: 0033:0xf7e6aead <snip> ---[ end trace 0000000000000000 ]--- (CVE-2024-26880)

  - 已解決 Linux 核心中的下列弱點：netfilter: nf_tables: flush pending destroy work before exit_net release Similar to 2c9f0293280e (netfilter: nf_tables: flush pending destroy work before netlink notifier) to address a race between exit_net and the destroy workqueue. The trace below shows an element to be released via destroy workqueue while exit_net path (triggered via module removal) has already released the set that is used in such transaction. [ 1360.547789] BUG: KASAN: slab-use-after-free in nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.547861] Read of size 8 at addr ffff888140500cc0 by task kworker/4:1/152465 [ 1360.547870] CPU: 4 PID: 152465 Comm: kworker/4:1 Not tainted 6.8.0+ #359 [ 1360.547882] Workqueue: events nf_tables_trans_destroy_work [nf_tables] [1360.547984] Call Trace: [ 1360.547991] <TASK> [ 1360.547998] dump_stack_lvl+0x53/0x70 [ 1360.548014] print_report+0xc4/0x610 [ 1360.548026] ? __virt_addr_valid+0xba/0x160 [ 1360.548040] ?
    __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 1360.548054] ? nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548176] kasan_report+0xae/0xe0 [ 1360.548189] ? nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548312] nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548447] ?
    __pfx_nf_tables_trans_destroy_work+0x10/0x10 [nf_tables] [ 1360.548577] ? _raw_spin_unlock_irq+0x18/0x30 [1360.548591] process_one_work+0x2f1/0x670 [ 1360.548610] worker_thread+0x4d3/0x760 [ 1360.548627] ?
    __pfx_worker_thread+0x10/0x10 [ 1360.548640] kthread+0x16b/0x1b0 [ 1360.548653] ? __pfx_kthread+0x10/0x10 [ 1360.548665] ret_from_fork+0x2f/0x50 [ 1360.548679] ? __pfx_kthread+0x10/0x10 [ 1360.548690] ret_from_fork_asm+0x1a/0x30 [ 1360.548707] </TASK> [ 1360.548719] Allocated by task 192061: [ 1360.548726] kasan_save_stack+0x20/0x40 [ 1360.548739] kasan_save_track+0x14/0x30 [ 1360.548750]
    __kasan_kmalloc+0x8f/0xa0 [ 1360.548760] __kmalloc_node+0x1f1/0x450 [ 1360.548771] nf_tables_newset+0x10c7/0x1b50 [nf_tables] [ 1360.548883] nfnetlink_rcv_batch+0xbc4/0xdc0 [nfnetlink] [1360.548909] nfnetlink_rcv+0x1a8/0x1e0 [nfnetlink] [ 1360.548927] netlink_unicast+0x367/0x4f0 [1360.548935] netlink_sendmsg+0x34b/0x610 [ 1360.548944] ____sys_sendmsg+0x4d4/0x510 [ 1360.548953]
    ___sys_sendmsg+0xc9/0x120 [ 1360.548961] __sys_sendmsg+0xbe/0x140 [ 1360.548971] do_syscall_64+0x55/0x120 [ 1360.548982] entry_SYSCALL_64_after_hwframe+0x55/0x5d [ 1360.548994] Freed by task 192222: [1360.548999] kasan_save_stack+0x20/0x40 [ 1360.549009] kasan_save_track+0x14/0x30 [ 1360.549019] kasan_save_free_info+0x3b/0x60 [ 1360.549028] poison_slab_object+0x100/0x180 [ 1360.549036]
    __kasan_slab_free+0x14/0x30 [ 1360.549042] kfree+0xb6/0x260 [ 1360.549049] __nft_release_table+0x473/0x6a0 [nf_tables] [ 1360.549131] nf_tables_exit_net+0x170/0x240 [nf_tables] [ 1360.549221] ops_exit_list+0x50/0xa0 [ 1360.549229] free_exit_list+0x101/0x140 [ 1360.549236] unregister_pernet_operations+0x107/0x160 [ 1360.549245] unregister_pernet_subsys+0x1c/0x30 [ 1360.549254] nf_tables_module_exit+0x43/0x80 [nf_tables] [ 1360.549345] __do_sys_delete_module+0x253/0x370 [1360.549352] do_syscall_64+0x55/0x120 [ 1360.549360] entry_SYSCALL_64_after_hwframe+0x55/0x5d (gdb) list
    *__nft_release_table+0x473 0x1e033 is in __nft_release_table (net/netfilter/nf_tables_api.c:11354). 11349 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) { 11350 list_del(&flowtable->list);
    11351 nft_use_dec(&table->use); 11352 nf_tables_flowtable_destroy(flowtable); 11353 } 11354 list_for_each_entry_safe(set, ns, &table->sets, list) { 11355 list_del(&set->list); 11356 nft_use_dec(&table->use); 11357 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 11358 nft_map_deactivat
    ---truncated--- (CVE-2024-35899)

  - 已解決 Linux 核心中的下列弱點：drm/client: Fully protect modes[] with dev->mode_config.mutex The modes[] array contains pointers to modes on the connectors' mode lists, which are protected by dev->mode_config.mutex. Thus we need to extend modes[] the same protection or by the time we use it the elements may already be pointing to freed/reused memory. (CVE-2024-35950)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Rocky Linux 9.6 主機已安裝的套件會受到 TuxCare ALMALINUX9.6：CLSA-2026：1792445930 公告中提及的多個弱點影響。

  - 已解決 Linux 核心中的下列弱點：virt: tdx-guest: Just leak decrypted memory on unrecoverable errors In CoCo VMs it is possible for the untrusted host to cause set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. Leak the decrypted memory when set_memory_decrypted() fails, and don't need to print an error since set_memory_decrypted() will call WARN_ONCE(). (CVE-2024-57793)

  - 已解決 Linux 核心中的下列弱點：crypto: af_alg - zero initialize memory allocated via sock_kmalloc Several crypto user API contexts and requests allocated with sock_kmalloc() were left uninitialized, relying on callers to set fields explicitly. This resulted in the use of uninitialized data in certain error paths or when new fields are added in the future. The ACVP patches also contain two user-space interface files: algif_kpp.c and algif_akcipher.c. These too rely on proper initialization of their context structures. A particular issue has been observed with the newly added 'inflight' variable introduced in af_alg_ctx by commit: 67b164a871af (crypto: af_alg - Disallow multiple in-flight AIO requests) Because the context is not memset to zero after allocation, the inflight variable has contained garbage values. As a result, af_alg_alloc_areq() has incorrectly returned -EBUSY randomly when the garbage value was interpreted as true:
    https://github.com/gregkh/linux/blame/master/crypto/af_alg.c#L1209 The check directly tests ctx->inflight without explicitly comparing against true/false. Since inflight is only ever set to true or false later, an uninitialized value has triggered -EBUSY failures. Zero-initializing memory allocated with sock_kmalloc() ensures inflight and other fields start in a known state, removing random issues caused by uninitialized data. (CVE-2025-71113)

  - 已解決 Linux 核心中的下列弱點：rxrpc: proc: size address buffers for %pISpc output The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with %pISpc. That is too small for the longest current-tree IPv6-with-port form the formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a dotted-quad tail not only for v4mapped addresses, but also for ISATAP addresses via ipv6_addr_is_isatap(). As a result, a case such as [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535 is possible with the current formatter. That is 50 visible characters, so 51 bytes including the trailing NUL, which does not fit in the existing char[50] buffers used by net/rxrpc/proc.c. Size the buffers from the formatter's maximum textual form and switch the call sites to scnprintf(). Changes since v1: - correct the changelog to cite the actual maximum current-tree case explicitly - frame the proof around the ISATAP formatting path instead of the earlier mapped-v4 example (CVE-2026-31630)

  - 已解決 Linux 核心中的下列弱點：netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets Userspace provides an optimized representation in case intervals are adjacent, where the end element is omitted. The existing partial overlap detection logic skips anonymous set checks on start elements for this reason. However, it is possible to add intervals that overlap to this anonymous where two start elements with the same, eg. A-B, A-C where C < B. start end A B start end A C Restore the check on overlapping start elements to report an overlap. (CVE-2026-45873)

  - 已解決 Linux 核心中的下列弱點：drm/amd/display: Bound VBIOS record-chain walk loops [Why & How] All record-chain walk loops in bios_parser.c and bios_parser2.c use for(;;) and only terminate on a 0xFF record_type sentinel or zero record_size. A malformed VBIOS image missing the terminator record causes unbounded iteration at probe time, potentially hundreds of thousands of iterations with record_size=1. In the final iterations near the BIOS image boundary, struct casts beyond the 2-byte header validated by GET_IMAGE can also read out of bounds. Cap all 14 record-chain walk loops to BIOS_MAX_NUM_RECORD (256) iterations. The atombios.h defines up to 22 distinct record types and atomfirmware.h has 13. Assuming an average of less than 10 records per type (which is reasonable since most are connector- based) 256 is a generous upper bound. (cherry picked from commit 95700a3d660287ed657d6892f7be9ffc0e294a93) (CVE-2026-53138)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Debian 12 主機已安裝的套件會受到 dla-4788 公告中提及的多個弱點影響。

    ------------------------------------------------------------------------- Debian LTS 公告 DLA-4788-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/Ben Hutchings 2026 年 9 月 19 日 https://wiki.debian.org/LTS-------------------------------------------------------------------------

    套件 ： linux-6.12 版本 ： 6.12.107-1~deb12u1 CVE ID ： CVE-2025-38525 CVE-2025-40054 CVE-2025-40074 CVE-2026-43197 CVE-2026-53092 CVE-2026-64017 CVE-2026-64216 CVE-2026-64581 CVE-2026-64586 CVE-2026-68082 CVE-2026-68118 CVE-2026-68132 CVE-2026-68138 CVE-2026-68159 CVE-2026-68166 CVE-2026-68169 CVE-2026-68198 CVE-2026-68253 CVE-2026-68254 CVE-2026-68264 CVE-2026-68266 CVE-2026-68267 CVE-2026-68273 CVE-2026-68276 CVE-2026-68322 CVE-2026-68367 CVE-2026-68431 CVE-2026-68451 CVE-2026-68452 CVE-2026-68480 CVE-2026-72111 CVE-2026-74440 CVE-2026-74441 CVE-2026-74442 CVE-2026-74443 CVE-2026-74444 CVE-2026-74445 CVE-2026-74446 CVE-2026-74447 CVE-2026-74448 CVE-2026-74450 CVE-2026-74451 CVE-2026-74452 CVE-2026-74453 CVE-2026-74454 CVE-2026-74455 CVE-2026-74456 CVE-2026-74457 CVE-2026-74458 CVE-2026-74459 CVE-2026-74460 CVE-2026-74461 CVE-2026-74463 CVE-2026-74464 CVE-2026-74465 CVE-2026-74467 CVE-2026-74468 CVE-2026-74469 CVE-2026-74470 CVE-2026-74471 CVE-2026-74472 CVE-2026-74473 CVE-2026-74474 CVE-2026-74475 CVE-2026-74476 CVE-2026-74478 CVE-2026-74479 CVE-2026-74480 CVE-2026-74481 CVE-2026-74482 CVE-2026-74483 CVE-2026-74484 CVE-2026-74485 CVE-2026-74487 CVE-2026-74488 CVE-2026-74490 CVE-2026-74492 CVE-2026-74493 CVE-2026-74494 CVE-2026-74495 CVE-2026-74497 CVE-2026-74498 CVE-2026-74499 CVE-2026-74500 CVE-2026-74501 CVE-2026-74502 CVE-2026-74503 CVE-2026-74504 CVE-2026-74505 CVE-2026-74507 CVE-2026-74508 CVE-2026-74509 CVE-2026-74510 CVE-2026-74512 CVE-2026-74514 CVE-2026-74515 CVE-2026-74516 CVE-2026-74517 CVE-2026-74518 CVE-2026-74519 CVE-2026-74522 CVE-2026-74523 CVE-2026-74524 CVE-2026-74525 CVE-2026-74531 CVE-2026-74532 CVE-2026-74535 CVE-2026-74536 CVE-2026-74540 CVE-2026-74541 CVE-2026-74543 CVE-2026-74545 CVE-2026-74546 CVE-2026-74547 CVE-2026-74548 CVE-2026-74549 CVE-2026-74550 CVE-2026-74551 CVE-2026-74552 CVE-2026-74553 CVE-2026-74555 CVE-2026-74556 CVE-2026-74557 CVE-2026-74563 CVE-2026-74564 CVE-2026-74565 CVE-2026-74566 CVE-2026-74567 CVE-2026-74569 CVE-2026-74572 CVE-2026-74574 CVE-2026-74575 CVE-2026-74576 CVE-2026-74577 CVE-2026-74579 CVE-2026-74580 CVE-2026-74581 CVE-2026-74582 CVE-2026-74583 CVE-2026-74585 CVE-2026-74586 CVE-2026-74587 CVE-2026-74588 CVE-2026-74589 CVE-2026-74590 CVE-2026-74592 CVE-2026-74594 CVE-2026-74595 CVE-2026-74597 CVE-2026-74598 CVE-2026-74599 CVE-2026-74601 CVE-2026-74602 CVE-2026-74603 CVE-2026-74604 CVE-2026-74606 CVE-2026-74607 CVE-2026-74608 CVE-2026-74609 CVE-2026-74610 CVE-2026-74612 CVE-2026-74613 CVE-2026-74614 CVE-2026-74615 CVE-2026-74616 CVE-2026-74618 CVE-2026-74619 CVE-2026-74620 CVE-2026-74621 CVE-2026-74622 CVE-2026-74623 CVE-2026-74624 CVE-2026-74625 CVE-2026-74626 CVE-2026-74628 CVE-2026-74630 CVE-2026-74631 CVE-2026-74632 CVE-2026-74634 CVE-2026-74635 CVE-2026-74636 CVE-2026-74637 CVE-2026-74641 CVE-2026-74644 CVE-2026-74646 CVE-2026-74647 CVE-2026-74648 CVE-2026-74649 CVE-2026-74650 CVE-2026-74651 CVE-2026-74653 CVE-2026-74654 CVE-2026-74655 CVE-2026-74656 CVE-2026-74657 CVE-2026-74658 CVE-2026-74659 CVE-2026-74660 CVE-2026-74661 CVE-2026-74662 CVE-2026-74663 CVE-2026-74664 CVE-2026-74665 CVE-2026-74666 CVE-2026-74667 CVE-2026-74668 CVE-2026-74669 CVE-2026-74670 CVE-2026-74671 CVE-2026-74672 CVE-2026-74673 CVE-2026-74675 CVE-2026-74676 CVE-2026-74677 CVE-2026-74678 CVE-2026-74679 CVE-2026-74680 CVE-2026-74682 CVE-2026-74683 CVE-2026-74684 CVE-2026-74685 CVE-2026-74688 CVE-2026-74689 CVE-2026-74691 CVE-2026-74692 CVE-2026-74693 CVE-2026-74694 CVE-2026-74696 CVE-2026-74700 CVE-2026-74701 CVE-2026-74704 CVE-2026-74705 CVE-2026-74710 CVE-2026-74712 CVE-2026-74714 CVE-2026-74717 CVE-2026-74718 CVE-2026-74719 CVE-2026-74720 CVE-2026-74722 CVE-2026-74724 CVE-2026-74725 CVE-2026-74726 CVE-2026-74730 CVE-2026-74732 CVE-2026-74736 CVE-2026-74737 CVE-2026-74739 CVE-2026-74740 CVE-2026-74742 CVE-2026-74743 CVE-2026-74744 CVE-2026-74746 CVE-2026-74748 CVE-2026-80522 CVE-2026-80525 CVE-2026-80526 CVE-2026-80527 CVE-2026-80528 CVE-2026-80529 CVE-2026-80530 CVE-2026-80531 CVE-2026-80532 CVE-2026-80533 CVE-2026-80534 CVE-2026-80535 CVE-2026-80536 CVE-2026-80539 CVE-2026-80540 CVE-2026-80541 CVE-2026-80547 CVE-2026-80548 CVE-2026-80549 CVE-2026-80550 CVE-2026-80551 CVE-2026-80552 CVE-2026-80553 CVE-2026-80554 CVE-2026-80555 CVE-2026-80556 CVE-2026-80557 CVE-2026-80558 CVE-2026-80559 CVE-2026-80560 CVE-2026-80561 CVE-2026-80562 CVE-2026-80563 CVE-2026-80565 CVE-2026-80566 CVE-2026-80567 CVE-2026-80568 CVE-2026-80569 CVE-2026-80570 CVE-2026-80572 CVE-2026-80573 CVE-2026-80574 CVE-2026-80575 CVE-2026-80576 CVE-2026-80577 CVE-2026-80578 CVE-2026-80583 CVE-2026-80584 CVE-2026-80585 CVE-2026-80586 CVE-2026-80587 CVE-2026-80589 CVE-2026-80590 CVE-2026-80678 CVE-2026-80679 CVE-2026-80680 CVE-2026-80681 CVE-2026-80684 CVE-2026-80686 CVE-2026-80689 CVE-2026-80691 CVE-2026-80694 CVE-2026-80695 CVE-2026-80696 CVE-2026-80700 CVE-2026-80702 CVE-2026-80703 CVE-2026-80704 CVE-2026-80706 CVE-2026-80707 CVE-2026-80708 CVE-2026-80709 CVE-2026-80710 CVE-2026-80711 CVE-2026-80714 CVE-2026-80715 CVE-2026-80716 CVE-2026-80717 CVE-2026-80718 CVE-2026-80722 CVE-2026-80723 CVE-2026-80725 CVE-2026-80726 CVE-2026-80727 CVE-2026-80728 CVE-2026-80730 CVE-2026-80731 CVE-2026-80732 CVE-2026-80733 CVE-2026-80736 CVE-2026-80737 CVE-2026-80739 CVE-2026-80742 CVE-2026-80743 CVE-2026-80744 CVE-2026-80749 CVE-2026-80752 CVE-2026-80754 CVE-2026-80756 CVE-2026-80757 CVE-2026-80759 CVE-2026-80763 CVE-2026-80764 CVE-2026-80765 CVE-2026-80767 CVE-2026-80770 CVE-2026-80771 CVE-2026-80772 CVE-2026-80779 CVE-2026-80781 CVE-2026-80782 CVE-2026-80784 CVE-2026-80788 CVE-2026-80789 CVE-2026-80790 CVE-2026-80791 CVE-2026-80792 CVE-2026-80793 CVE-2026-80794 CVE-2026-80795 CVE-2026-80797 CVE-2026-80798 CVE-2026-80799 CVE-2026-80800 CVE-2026-80801 CVE-2026-80802 CVE-2026-80803 CVE-2026-80805 CVE-2026-80808 CVE-2026-80809 CVE-2026-80812 CVE-2026-80814 CVE-2026-80815 CVE-2026-80819 CVE-2026-80820 CVE-2026-80823 CVE-2026-80887 CVE-2026-80888 CVE-2026-80889 CVE-2026-80890 CVE-2026-80891 CVE-2026-80892 CVE-2026-80893 CVE-2026-80894 CVE-2026-80901 CVE-2026-80902 CVE-2026-80903 CVE-2026-80904 CVE-2026-80906 CVE-2026-80907 CVE-2026-80908 CVE-2026-80909 CVE-2026-80910 CVE-2026-80911 CVE-2026-80912 CVE-2026-80913 CVE-2026-80915 CVE-2026-80916 CVE-2026-80917 CVE-2026-80918 Debian 錯誤 ： 1142912 1143545

    在 Linux 核心中發現數個弱點，這些弱點可能會導致特權提升、拒絕服務或資訊洩漏。

    對於 Debian 12 書蟲，這些問題已在 6.12.107-1~deb12u1 版本中修復。此更新還包括來自穩定更新 6.12.102-6.12.107的更多錯誤修復，並添加了 Alcor 讀卡器的驅動程序。

    我們建議您升級 linux-6.12 套件。

    有關 linux-6.12 的詳細安全性狀態，請參閱其安全性追蹤器頁面：
    https://security-tracker.debian.org/tracker/linux-6.12

    有關 Debian LTS 安全公告、如何將這些更新套用至您的系統以及常見問題的詳細資訊，請參閱：https://wiki.debian.org/LTSAttachment:signature.ascDescription: PGP 簽章

Tenable 已直接從 Debian 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

AlmaLinux 9.6 主機已安裝的套件會受到 TuxCare ALMALINUX9.6：CLSA-2026：1792445930 公告中提及的多個弱點影響。

  - 已解決 Linux 核心中的下列弱點：virt: tdx-guest: Just leak decrypted memory on unrecoverable errors In CoCo VMs it is possible for the untrusted host to cause set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. Leak the decrypted memory when set_memory_decrypted() fails, and don't need to print an error since set_memory_decrypted() will call WARN_ONCE(). (CVE-2024-57793)

  - 已解決 Linux 核心中的下列弱點：crypto: af_alg - zero initialize memory allocated via sock_kmalloc Several crypto user API contexts and requests allocated with sock_kmalloc() were left uninitialized, relying on callers to set fields explicitly. This resulted in the use of uninitialized data in certain error paths or when new fields are added in the future. The ACVP patches also contain two user-space interface files: algif_kpp.c and algif_akcipher.c. These too rely on proper initialization of their context structures. A particular issue has been observed with the newly added 'inflight' variable introduced in af_alg_ctx by commit: 67b164a871af (crypto: af_alg - Disallow multiple in-flight AIO requests) Because the context is not memset to zero after allocation, the inflight variable has contained garbage values. As a result, af_alg_alloc_areq() has incorrectly returned -EBUSY randomly when the garbage value was interpreted as true:
    https://github.com/gregkh/linux/blame/master/crypto/af_alg.c#L1209 The check directly tests ctx->inflight without explicitly comparing against true/false. Since inflight is only ever set to true or false later, an uninitialized value has triggered -EBUSY failures. Zero-initializing memory allocated with sock_kmalloc() ensures inflight and other fields start in a known state, removing random issues caused by uninitialized data. (CVE-2025-71113)

  - 已解決 Linux 核心中的下列弱點：rxrpc: proc: size address buffers for %pISpc output The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with %pISpc. That is too small for the longest current-tree IPv6-with-port form the formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a dotted-quad tail not only for v4mapped addresses, but also for ISATAP addresses via ipv6_addr_is_isatap(). As a result, a case such as [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535 is possible with the current formatter. That is 50 visible characters, so 51 bytes including the trailing NUL, which does not fit in the existing char[50] buffers used by net/rxrpc/proc.c. Size the buffers from the formatter's maximum textual form and switch the call sites to scnprintf(). Changes since v1: - correct the changelog to cite the actual maximum current-tree case explicitly - frame the proof around the ISATAP formatting path instead of the earlier mapped-v4 example (CVE-2026-31630)

  - 已解決 Linux 核心中的下列弱點：netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets Userspace provides an optimized representation in case intervals are adjacent, where the end element is omitted. The existing partial overlap detection logic skips anonymous set checks on start elements for this reason. However, it is possible to add intervals that overlap to this anonymous where two start elements with the same, eg. A-B, A-C where C < B. start end A B start end A C Restore the check on overlapping start elements to report an overlap. (CVE-2026-45873)

  - 已解決 Linux 核心中的下列弱點：drm/amd/display: Bound VBIOS record-chain walk loops [Why & How] All record-chain walk loops in bios_parser.c and bios_parser2.c use for(;;) and only terminate on a 0xFF record_type sentinel or zero record_size. A malformed VBIOS image missing the terminator record causes unbounded iteration at probe time, potentially hundreds of thousands of iterations with record_size=1. In the final iterations near the BIOS image boundary, struct casts beyond the 2-byte header validated by GET_IMAGE can also read out of bounds. Cap all 14 record-chain walk loops to BIOS_MAX_NUM_RECORD (256) iterations. The atombios.h defines up to 22 distinct record types and atomfirmware.h has 13. Assuming an average of less than 10 records per type (which is reasonable since most are connector- based) 256 is a generous upper bound. (cherry picked from commit 95700a3d660287ed657d6892f7be9ffc0e294a93) (CVE-2026-53138)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Ubuntu 24.04 LTS 主機上安裝的一個套件受到 USN-8886-1 公告中所提及的多個弱點影響。

    在 Linux 核心中發現數個安全性問題。攻擊者可能會利用這些弱點入侵系統。此更新可更正下列子系統中的瑕疵：

    - NVDIMM (非易失性記憶體裝置) 驅動程式；

    - 交握 API；

    - ARM32 架構；

    - ARM64 架構 ;

    - MIPS 架構；

    - OpenRISC 架構；

    - PowerPC 架構；

    - S390 架構；

    - x86 架構;

    - 區塊層子系統；

    - 密碼編譯 API;

    - 英特爾 NPU 驅動程式;

    - Android 驅動程式 ;

    - Rados 區塊裝置 （RBD） 驅動程式;

    - 藍牙驅動程式;

    - 硬體亂數產生器核心；

    - TPM 裝置驅動程式；

    - CPU 頻率縮放架構;

    - 硬體加密裝置驅動程式；

    - DMA 引擎子系統;

    - FireWire 子系統；

    - 適用於 ARMv8-A(FFA) 的 Arm 韌體架構；

    - GPIO 子系統；

    - GPU 驅動程式；

    - HID 子系統 ;

    - 硬體監控驅動程式;

    - CoreSight 硬體追蹤驅動程式;

    - I2C 子系統；

    - IIO ADC 驅動程式；

    - IIO 子系統；

    - InfiniBand 驅動程式;

    - 輸入裝置核心驅動程式;

    - 輸入裝置 (滑鼠) 驅動程式；

    - IOMMU 子系統;

    - 多個裝置驅動程式；

    - 媒體驅動程式；

    - 多功能裝置驅動程式；

    - Fastrpc 驅動程式 ;

    - Amazon Nitro 安全模組驅動程式;

    - MMC 子系統；

    - MTD 區塊裝置驅動程式；

    - 乙太網路綁定驅動程式；

    - 網路驅動程式；

    - Mellanox 網路驅動程式；

    - Texas Instruments 網路驅動程式；

    - NTB 驅動程式；

    - NVME 驅動程式；

    - NVMEM（非揮發性記憶體）驅動程式;

    - Parport 驅動程式；

    - 針腳控制器子系統；

    - x86 平台驅動程式；

    - i.MX PM 網域；

    - 系統重置/關閉驅動程序;

    - PTP 時鐘架構；

    - 電壓和電流調節器驅動程式；

    - S/390 驅動程式 ;

    - SCSI 子系統 ;

    - SPI 子系統；

    - Realtek RTL8723BS SDIO 驅動程式；

    - VME 匯流排暫存驅動程式;

    - 熱驅動程式；

    - Thunderbolt 和 USB4 驅動程式 ;

    - TTY 驅動程式；

    - DesignWare USB2 驅動程式;

    - USB Gadget 驅動程式；

    - USB 主機控制器驅動程式；

    - USB Dual Role (OTG-ready) 控制器驅動程式；

    - USB 序列驅動程式；

    - USB Type-C Port Controller Manager 驅動程式；

    - vDPA 驅動程式;

    - Virtio Host (VHOST) 子系統;

    - Framebuffer 層；

    - Watchdog 驅動程式；

    - 9P 分散式檔案系統 ;

    - AFS 檔案系統;

    - 檔案系統基礎架構；

    - BTRFS 檔案系統 ;

    - Ceph 分散式檔案系統；

    - EROFS 檔案系統；

    - AexFAT 檔案系統；

    - F2FS 檔案系統；

    - FUSE (使用者空間中的檔案系統)；

    - 區塊裝置的日誌記錄層 (JBD2)；

    - 網路檔案系統 (NFS) 用戶端；

    - 網路檔案系統 (NFS) 伺服器程序；

    - NTFS3 檔案系統；

    - OCFS2 檔案系統；

    - Proc 檔案系統；

    - SMB 網路檔案系統 ;

    - 追蹤檔案系統 ;

    - UDF 檔案系統；

    - XFS 檔案系統；

    - 金鑰管理；

    - BPF 子系統；

    - 控制群組 (cgroup);

    - Glob 模式匹配庫;

    - MAC80211 子系統；

    - Mellanox 驅動程式；

    - 網路核心；

    - 網路通訊端；

    - IPv6 網路；

    - 藍牙子系統；

    - 無線網路 ；

    - IPv4 網路；

    - Netfilter；

    - 網路流量控制 ;

    - SCTP 通訊協定；

    - TCP 網路通訊協定；

    - XFRM 子系統；

    - RDMA 動詞 API；

    - io_uring 子系統;

    - IPC 子系統；

    - 稽核子系統；

    - Kernel CPU 控制基礎架構；

    - Perf 事件；

    - 核心 exit() 系統呼叫；

    - 核心 fork() 系統呼叫；

    - 排程器基礎架構；

    - 訊號處理機制；

    - Timer 子系統;

    - 追蹤基礎架構；

    - 可調整大小的雜湊表庫;

    - 記憶體管理；

    - 6LoWPAN網路協定;

    - 非同步傳輸模式 (ATM) 子系統；

    - B.A.T.M.A.N. 網狀通訊協定；

    - 乙太網路橋接器；

    - CAN 網路層

    - Ceph Core 程式庫；

    - Ethtool 驅動程式；

    - HSR 網路通訊協定；

    - IEEE802154.4 網路通訊協定；

    - IUCV 驅動程式；

    - KCM (核心連線多工器) 通訊端驅動程式 ;

    - IEEE 802.15.4 子系統；

    - 多重路徑 TCP;

    Open vSwitch；

    - 封包通訊端；

    - Phonet 通訊協定 ;

    - 高通IPC路由器（QRTR）;

    - RDS 通訊協定;

    - RxRPC 工作階段通訊端；

    - SMC 通訊端;

    - Sun RPC 通訊協定；

    - TIPC 通訊協定 ;

    - TLS 通訊協定；

    - Unix 網域通訊端;

    - VMware vSockets 驅動程式；

    - X.25 network layer;

    - eXpress 資料路徑；

    - AppArmor 安全性模組 ;

    - 完整性測量架構 (IMA) 框架；

    - SELinux 安全性模組；

    - ALSA 架構;

    - HD 音訊驅動程式；

    - QCOM ASoC 驅動程式；

    - 簡單的音頻多路復用器編解碼器驅動程序;

    - Texas InstrumentS Audio (ASoC/HDA) 驅動程式 ;

    - 適用於 Freescale CPU 的 SoC Audio 驅動程式 ;

    - Amlogic Meson SoC 驅動程式；

    - SOF 驅動程式；

    - NVIDIA Tegra ASoC 驅動程式;

    - USB 音效裝置；

    - 性能工具;

    - KVM 子系統;（CVE-2025-37807 ， ， ， CVE-2026-43022， CVE-2026-46321CVE-2026-53267CVE-2026-53160CVE-2026-53161CVE-2026-53136CVE-2026-53137CVE-2026-52994CVE-2026-53143CVE-2026-53138CVE-2026-53146CVE-2026-53147CVE-2026-53149CVE-2026-53156CVE-2026-53157CVE-2026-52947CVE-2026-53189CVE-2026-53184CVE-2026-53194CVE-2026-53195CVE-2026-53199CVE-2026-53202CVE-2026-53205CVE-2026-52943CVE-2026-53223CVE-2026-53209CVE-2026-53229CVE-2026-53253CVE-2026-53255CVE-2026-53268CVE-2026-53272CVE-2026-52942CVE-2026-53330CVE-2026-53329CVE-2026-53389CVE-2026-53388CVE-2026-53390CVE-2026-53387CVE-2026-53383CVE-2026-53381CVE-2026-53391CVE-2026-53366CVE-2026-53365CVE-2026-53362CVE-2026-53392CVE-2026-53356CVE-2026-52935CVE-2026-53397CVE-2026-63794CVE-2026-53402CVE-2026-63802CVE-2026-53401CVE-2026-63803CVE-2026-63805CVE-2026-46322CVE-2026-52923CVE-2026-63806CVE-2026-52917CVE-2026-52927CVE-2026-52929CVE-2026-53400CVE-2026-23265、、、 CVE-2026-64005CVE-2026-63869CVE-2026-63867CVE-2026-63870CVE-2026-63875CVE-2026-63879CVE-2026-63881CVE-2026-63884CVE-2026-63833CVE-2026-63909CVE-2026-63889CVE-2026-63913CVE-2026-63920CVE-2026-63925CVE-2026-63927CVE-2026-63930CVE-2026-63827CVE-2026-63954CVE-2026-63942CVE-2026-63968CVE-2026-63970CVE-2026-63971CVE-2026-63985CVE-2026-64002CVE-2026-63824CVE-2026-64004CVE-2026-64003CVE-2026-64009CVE-2026-64017CVE-2026-64023CVE-2026-64239CVE-2026-64222CVE-2026-64210CVE-2026-64242CVE-2026-64189CVE-2026-64188CVE-2026-64123CVE-2026-64243CVE-2026-64095CVE-2026-64036CVE-2026-64026CVE-2026-64245CVE-2026-63823CVE-2026-63817CVE-2026-64277CVE-2026-64272CVE-2026-64276CVE-2026-64266CVE-2026-64270CVE-2026-64271CVE-2026-64274CVE-2026-64279CVE-2026-63819CVE-2026-64273CVE-2026-63816CVE-2026-64246CVE-2026-63814CVE-2026-63812CVE-2026-63809、 、 、 、 CVE-2026-64418CVE-2026-64322CVE-2026-64318CVE-2026-64324CVE-2026-64323CVE-2026-64333CVE-2026-64368CVE-2026-64372CVE-2026-64374CVE-2026-64375CVE-2026-64317CVE-2026-64379CVE-2026-64378CVE-2026-64380CVE-2026-64388CVE-2026-64389CVE-2026-64395CVE-2026-64398CVE-2026-64312CVE-2026-64402CVE-2026-64401CVE-2026-64403CVE-2026-64411CVE-2026-64412CVE-2026-64413CVE-2026-64442CVE-2026-64440CVE-2026-64443CVE-2026-64436CVE-2026-64435CVE-2026-64432CVE-2026-64444CVE-2026-64430CVE-2026-64423CVE-2026-64422CVE-2026-64448CVE-2026-64420CVE-2026-64304CVE-2026-64299CVE-2026-64298CVE-2026-64532CVE-2026-64463CVE-2026-64468CVE-2026-64469CVE-2026-64456CVE-2026-64496CVE-2026-64533CVE-2026-64481CVE-2026-64449CVE-2026-64452CVE-2026-64524CVE-2026-64296CVE-2026-64287CVE-2026-64286CVE-2026-64283、 、 、 、 CVE-2026-68104CVE-2026-64563CVE-2026-64560CVE-2026-64568CVE-2026-64567CVE-2026-64570CVE-2026-64574CVE-2026-64576CVE-2026-64577CVE-2026-64578CVE-2026-64556CVE-2026-64581CVE-2026-64580CVE-2026-64582CVE-2026-64583CVE-2026-64584CVE-2026-64585CVE-2026-64599CVE-2026-64550CVE-2026-68091CVE-2026-64600CVE-2026-68096CVE-2026-68097CVE-2026-68098CVE-2026-68100CVE-2026-68129CVE-2026-68125CVE-2026-68131CVE-2026-68121CVE-2026-68119CVE-2026-68118CVE-2026-68140CVE-2026-68116CVE-2026-68108CVE-2026-68107CVE-2026-68141CVE-2026-68106CVE-2026-64547CVE-2026-64546CVE-2026-64545CVE-2026-68179CVE-2026-68148CVE-2026-68149CVE-2026-68153CVE-2026-68145CVE-2026-68157CVE-2026-68189CVE-2026-68155CVE-2026-68142CVE-2026-68143CVE-2026-68178CVE-2026-64543CVE-2026-64540CVE-2026-64539CVE-2026-64536、 、 、 、 CVE-2026-68329CVE-2026-68253CVE-2026-68245CVE-2026-68258CVE-2026-68255CVE-2026-68260CVE-2026-68262CVE-2026-68263CVE-2026-68266CVE-2026-68273CVE-2026-68236CVE-2026-68287CVE-2026-68284CVE-2026-68290CVE-2026-68293CVE-2026-68294CVE-2026-68297CVE-2026-68299CVE-2026-68222CVE-2026-68315CVE-2026-68314CVE-2026-68320CVE-2026-68322CVE-2026-68323CVE-2026-68326CVE-2026-68371CVE-2026-68370CVE-2026-68373CVE-2026-68354CVE-2026-68353CVE-2026-68352CVE-2026-68376CVE-2026-68348CVE-2026-68340CVE-2026-68338CVE-2026-68377CVE-2026-68335CVE-2026-68219CVE-2026-68216CVE-2026-68204CVE-2026-68402CVE-2026-68392CVE-2026-68397CVE-2026-68398CVE-2026-68391CVE-2026-68400CVE-2026-68404CVE-2026-68399CVE-2026-68383CVE-2026-68389CVE-2026-68401CVE-2026-68202CVE-2026-68199CVE-2026-68196CVE-2026-68192、 、 、 、 CVE-2026-72049CVE-2026-68446CVE-2026-68445CVE-2026-68451CVE-2026-68447CVE-2026-68452CVE-2026-68453CVE-2026-68454CVE-2026-68466CVE-2026-68467CVE-2026-68442CVE-2026-68474CVE-2026-68471CVE-2026-68479CVE-2026-72005CVE-2026-72009CVE-2026-72012CVE-2026-72019CVE-2026-68433CVE-2026-72024CVE-2026-72021CVE-2026-72029CVE-2026-72035CVE-2026-72036CVE-2026-72045CVE-2026-72067CVE-2026-72066CVE-2026-72072CVE-2026-72061CVE-2026-72057CVE-2026-72055CVE-2026-72089CVE-2026-72054CVE-2026-72053CVE-2026-72052CVE-2026-72099CVE-2026-72051CVE-2026-68432CVE-2026-68425CVE-2026-68419CVE-2026-72116CVE-2026-72108CVE-2026-72109CVE-2026-72110CVE-2026-72107CVE-2026-72114CVE-2026-72117CVE-2026-72113CVE-2026-72102CVE-2026-72105CVE-2026-72115CVE-2026-68417CVE-2026-68414CVE-2026-68409CVE-2026-68408、 、 、 、 CVE-2026-72233CVE-2026-72146CVE-2026-72144CVE-2026-72149CVE-2026-72148CVE-2026-72157CVE-2026-72160CVE-2026-72162CVE-2026-72164CVE-2026-72165CVE-2026-72136CVE-2026-72171CVE-2026-72170CVE-2026-72172CVE-2026-72175CVE-2026-72181CVE-2026-72195CVE-2026-72196CVE-2026-72135CVE-2026-72213CVE-2026-72197CVE-2026-72225CVE-2026-72227CVE-2026-72231CVE-2026-72232CVE-2026-72254CVE-2026-72253CVE-2026-72261CVE-2026-72252CVE-2026-72250CVE-2026-72247CVE-2026-72262CVE-2026-72244CVE-2026-72243CVE-2026-72242CVE-2026-72282CVE-2026-72235CVE-2026-72133CVE-2026-72123CVE-2026-72122CVE-2026-72330CVE-2026-72301CVE-2026-72302CVE-2026-72304CVE-2026-72298CVE-2026-72312CVE-2026-72334CVE-2026-72310CVE-2026-72284CVE-2026-72297CVE-2026-72314CVE-2026-72121CVE-2026-72120CVE-2026-72119CVE-2026-72118、 、 、 、 CVE-2026-72435CVE-2026-72373CVE-2026-72371CVE-2026-72375CVE-2026-72374CVE-2026-72378CVE-2026-72382CVE-2026-72389CVE-2026-72390CVE-2026-72397CVE-2026-72369CVE-2026-72404CVE-2026-72400CVE-2026-72405CVE-2026-72406CVE-2026-72409CVE-2026-72410CVE-2026-72416CVE-2026-72352CVE-2026-72419CVE-2026-72418CVE-2026-72420CVE-2026-72423CVE-2026-72425CVE-2026-72427CVE-2026-72469CVE-2026-72464CVE-2026-72470CVE-2026-72460CVE-2026-72459CVE-2026-72450CVE-2026-72476CVE-2026-72449CVE-2026-72444CVE-2026-72440CVE-2026-72478CVE-2026-72438CVE-2026-72350CVE-2026-72347CVE-2026-72343CVE-2026-74270CVE-2026-72492CVE-2026-72502CVE-2026-74256CVE-2026-72485CVE-2026-74258CVE-2026-74281CVE-2026-74257CVE-2026-72480CVE-2026-72483CVE-2026-74262CVE-2026-72342CVE-2026-72340CVE-2026-72338CVE-2026-72335、 、 、 、 CVE-2026-74378CVE-2026-74300CVE-2026-74297CVE-2026-74313CVE-2026-74312CVE-2026-74314CVE-2026-74317CVE-2026-74321CVE-2026-74330CVE-2026-74334CVE-2026-74296CVE-2026-74340CVE-2026-74338CVE-2026-74341CVE-2026-74344CVE-2026-74347CVE-2026-74349CVE-2026-74356CVE-2026-74295CVE-2026-74363CVE-2026-74359CVE-2026-74365CVE-2026-74374CVE-2026-74375CVE-2026-74377CVE-2026-74444CVE-2026-74443CVE-2026-74446CVE-2026-74438CVE-2026-74397CVE-2026-74390CVE-2026-74450CVE-2026-74388CVE-2026-74387CVE-2026-74385CVE-2026-74453CVE-2026-74380CVE-2026-74294CVE-2026-74293CVE-2026-74292CVE-2026-74481CVE-2026-74465CVE-2026-74467CVE-2026-74469CVE-2026-74461CVE-2026-74471CVE-2026-74482CVE-2026-74470CVE-2026-74454CVE-2026-74456CVE-2026-74479CVE-2026-74289CVE-2026-74288CVE-2026-74283CVE-2026-74282、 、 、 、 CVE-2026-74557CVE-2026-74512CVE-2026-74510CVE-2026-74516CVE-2026-74515CVE-2026-74518CVE-2026-74519CVE-2026-74522CVE-2026-74523CVE-2026-74527CVE-2026-74509CVE-2026-74531CVE-2026-74530CVE-2026-74533CVE-2026-74534CVE-2026-74535CVE-2026-74536CVE-2026-74537CVE-2026-74508CVE-2026-74544CVE-2026-74540CVE-2026-74548CVE-2026-74549CVE-2026-74550CVE-2026-74551CVE-2026-74579CVE-2026-74578CVE-2026-74580CVE-2026-74575CVE-2026-74574CVE-2026-74572CVE-2026-74581CVE-2026-74567CVE-2026-74565CVE-2026-74564CVE-2026-74582CVE-2026-74563CVE-2026-74507CVE-2026-74497CVE-2026-74496CVE-2026-74595CVE-2026-74587CVE-2026-74588CVE-2026-74589CVE-2026-74586CVE-2026-74592CVE-2026-74597CVE-2026-74590CVE-2026-74583CVE-2026-74584CVE-2026-74594CVE-2026-74492CVE-2026-74490CVE-2026-74488CVE-2026-74485、 、 、 、 CVE-2026-74649CVE-2026-74611CVE-2026-74610CVE-2026-74613CVE-2026-74612CVE-2026-74614CVE-2026-74615CVE-2026-74616CVE-2026-74621CVE-2026-74624CVE-2026-74609CVE-2026-74626CVE-2026-74625CVE-2026-74628CVE-2026-74630CVE-2026-74631CVE-2026-74632CVE-2026-74634CVE-2026-74608CVE-2026-74637CVE-2026-74635CVE-2026-74641CVE-2026-74646CVE-2026-74647CVE-2026-74648CVE-2026-74668CVE-2026-74667CVE-2026-74669CVE-2026-74666CVE-2026-74663CVE-2026-74662CVE-2026-74670CVE-2026-74661CVE-2026-74660CVE-2026-74656CVE-2026-74675CVE-2026-74651CVE-2026-74607CVE-2026-74606CVE-2026-74605CVE-2026-74696CVE-2026-74688CVE-2026-74689CVE-2026-74690CVE-2026-74687CVE-2026-74692CVE-2026-74697CVE-2026-74691CVE-2026-74678CVE-2026-74684CVE-2026-74695CVE-2026-74604CVE-2026-74603CVE-2026-74601CVE-2026-74598、 、 、 、 CVE-2026-80540CVE-2026-74720CVE-2026-74717CVE-2026-74724CVE-2026-74723CVE-2026-74725CVE-2026-74726CVE-2026-74730CVE-2026-74733CVE-2026-74736CVE-2026-74715CVE-2026-74739CVE-2026-74737CVE-2026-74743CVE-2026-74744CVE-2026-74746CVE-2026-74747CVE-2026-74748CVE-2026-74714CVE-2026-80521CVE-2026-74752CVE-2026-80526CVE-2026-80527CVE-2026-80528CVE-2026-80536CVE-2026-80554CVE-2026-80553CVE-2026-80555CVE-2026-80552CVE-2026-80551CVE-2026-80550CVE-2026-80556CVE-2026-80549CVE-2026-80548CVE-2026-80547CVE-2026-80557CVE-2026-80541CVE-2026-74713CVE-2026-74711CVE-2026-74710CVE-2026-80574CVE-2026-80561CVE-2026-80565CVE-2026-80568CVE-2026-80560CVE-2026-80570CVE-2026-80576CVE-2026-80569CVE-2026-80558CVE-2026-80559CVE-2026-80572CVE-2026-74705CVE-2026-74704CVE-2026-74701CVE-2026-74700CVE-2026-80578、CVE-2026-80579、、CVE-2026-80580、CVE-2026-80583CVE-2026-80901CVE-2026-97509CVE-2026-80589CVE-2026-80586CVE-2026-80721CVE-2026-80584CVE-2026-80585CVE-2026-80587）

Tenable 已直接從 Ubuntu 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

CentOS Linux 8.5 主機已安裝的套件會受到 TuxCare CENTOS8.5：CLSA-2026：1792979985 公告中提及的多個弱點影響。

  - 已解決 Linux 核心中的下列弱點：net: bridge: fix vlan tunnel dst refcnt when egressing The egress tunnel code uses dst_clone() and directly sets the result which is wrong because the entry might have 0 refcnt or be already deleted, causing number of problems. It also triggers the WARN_ON() in dst_hold()[1] when a refcnt couldn't be taken. Fix it by using dst_hold_safe() and checking if a reference was actually taken before setting the dst. [1] dmesg WARN_ON log and following refcnt errors WARNING: CPU: 5 PID: 38 at include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge] Modules linked in: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net CPU: 5 PID: 38 Comm:
    ksoftirqd/5 Kdump: loaded Tainted: G W 5.13.0-rc3+ #360 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 RIP: 0010:br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge] Code: e8 85 bc 01 e1 45 84 f6 74 90 45 31 f6 85 db 48 c7 c7 a0 02 19 a0 41 0f 94 c6 31 c9 31 d2 44 89 f6 e8 64 bc 01 e1 85 db 75 02 <0f> 0b 31 c9 31 d2 44 89 f6 48 c7 c7 70 02 19 a0 e8 4b bc 01 e1 49 RSP:
    0018:ffff8881003d39e8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffa01902a0 RBP: ffff8881040c6700 R08:
    0000000000000000 R09: 0000000000000001 R10: 2ce93d0054fe0d00 R11: 54fe0d00000e0000 R12: ffff888109515000 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000401 FS: 0000000000000000(0000) GS:ffff88822bf40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
    00007f42ba70f030 CR3: 0000000109926000 CR4: 00000000000006e0 Call Trace: br_handle_vlan+0xbc/0xca [bridge]
    __br_forward+0x23/0x164 [bridge] deliver_clone+0x41/0x48 [bridge] br_handle_frame_finish+0x36f/0x3aa [bridge] ? skb_dst+0x2e/0x38 [bridge] ? br_handle_ingress_vlan_tunnel+0x3e/0x1c8 [bridge] ? br_handle_frame_finish+0x3aa/0x3aa [bridge] br_handle_frame+0x2c3/0x377 [bridge] ? __skb_pull+0x33/0x51 ? vlan_do_receive+0x4f/0x36a ? br_handle_frame_finish+0x3aa/0x3aa [bridge]
    __netif_receive_skb_core+0x539/0x7c6 ? __list_del_entry_valid+0x16e/0x1c2
    __netif_receive_skb_list_core+0x6d/0xd6 netif_receive_skb_list_internal+0x1d9/0x1fa gro_normal_list+0x22/0x3e dev_gro_receive+0x55b/0x600 ? detach_buf_split+0x58/0x140 napi_gro_receive+0x94/0x12e virtnet_poll+0x15d/0x315 [virtio_net] __napi_poll+0x2c/0x1c9 net_rx_action+0xe6/0x1fb __do_softirq+0x115/0x2d8 run_ksoftirqd+0x18/0x20 smpboot_thread_fn+0x183/0x19c ? smpboot_unregister_percpu_thread+0x66/0x66 kthread+0x10a/0x10f ? kthread_mod_delayed_work+0xb6/0xb6 ret_from_fork+0x22/0x30 ---[ end trace 49f61b07f775fd2b ]--- dst_release: dst:00000000c02d677a refcnt:-1 dst_release underflow (CVE-2021-47222)

  - 已解決 Linux 核心中的下列弱點：net: bridge: fix vlan tunnel dst null pointer dereference This patch fixes a tunnel_dst null pointer dereference due to lockless access in the tunnel egress path. When deleting a vlan tunnel the tunnel_dst pointer is set to NULL without waiting a grace period (i.e. while it's still usable) and packets egressing are dereferencing it without checking.
    Use READ/WRITE_ONCE to annotate the lockless use of tunnel_id, use RCU for accessing tunnel_dst and make sure it is read only once and checked in the egress path. The dst is already properly RCU protected so we don't need to do anything fancy than to make sure tunnel_id and tunnel_dst are read only once and checked in the egress path. (CVE-2021-47223)

  - 已解決 Linux 核心中的下列弱點：bpf: Guard stack limits against 32bit overflow This patch promotes the arithmetic around checking stack bounds to be done in the 64-bit domain, instead of the current 32bit. The arithmetic implies adding together a 64-bit register with a int offset.
    The register was checked to be below 1<<29 when it was variable, but not when it was fixed. The offset either comes from an instruction (in which case it is 16 bit), from another register (in which case the caller checked it to be below 1<<29 [1]), or from the size of an argument to a kfunc (in which case it can be a u32 [2]). Between the register being inconsistently checked to be below 1<<29, and the offset being up to an u32, it appears that we were open to overflowing the `int`s which were currently used for arithmetic. [1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498 [2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904 (CVE-2023-52676)

  - 已解決 Linux 核心中的下列弱點：cifs: fix session state check in reconnect to avoid use-after-free issue Don't collect exiting session in smb2_reconnect_server(), because it will be released soon. Note that the exiting session will stay in server->smb_ses_list until it complete the cifs_free_ipc() and logoff() and then delete itself from the list. (CVE-2023-53794)

  - 已解決 Linux 核心中的下列弱點：ubi: Fix use-after-free when volume resizing failed There is an use-after-free problem reported by KASAN:
    ================================================================== BUG: KASAN: use-after-free in ubi_eba_copy_table+0x11f/0x1c0 [ubi] Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735 CPU: 2 PID: 4735 Comm: ubirsvol Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 ubi_eba_copy_table+0x11f/0x1c0 [ubi] ubi_resize_volume+0x4f9/0xbc0 [ubi] ubi_cdev_ioctl+0x701/0x1850 [ubi] __x64_sys_ioctl+0x11d/0x170 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> When ubi_change_vtbl_record() returns an error in ubi_resize_volume(), new_eba_tbl will be freed on error handing path, but it is holded by vol->eba_tbl in ubi_eba_replace_table(). It means that the liftcycle of vol->eba_tbl and vol are different, so when resizing volume in next time, it causing an use-after-free fault. Fix it by not freeing new_eba_tbl after it replaced in ubi_eba_replace_table(), while will be freed in next volume resizing. (CVE-2023-53800)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - drm/amd/pm：修正 pptable 釋放後使用amdgpu_dpm_get_pp_table（） 在刪除 adev->pm.mutex 後傳回指向驅動程式擁有電源表的指標。然後，sysfs 路徑會從該指標複製。並行pp_table寫入可以在複製期間取代和釋放分配，從而導致釋放後使用。變更 DPM 介面，以在保留互斥時複製到呼叫端提供的儲存體。保留屬性探索的僅大小查詢，而不公開驅動程式擁有的指標。（從提交 f6eed7acfd30099ef7baeb6ba45bb59daad80631 中挑選）（CVE-2026-74450）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

遠端 Debian 13 主機已安裝的套件會受到 dsa-6466 公告中提及的多個弱點影響。

    - ------------------------------------------------------------------------- Debian安全公告 DSA-6466-1 security@debian.org https://www.debian.org/security/Salvatore Bonaccorso 2026 年 8 月 25 日 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    套件 ： linux CVE ID ： CVE-2025-38525 CVE-2025-40054 CVE-2026-43197 CVE-2026-53092 CVE-2026-64017 CVE-2026-64586 CVE-2026-68082 CVE-2026-68118 CVE-2026-68132 CVE-2026-68138 CVE-2026-68159 CVE-2026-68166 CVE-2026-68169 CVE-2026-68198 CVE-2026-68253 CVE-2026-68254 CVE-2026-68264 CVE-2026-68266 CVE-2026-68267 CVE-2026-68273 CVE-2026-68276 CVE-2026-68322 CVE-2026-68367 CVE-2026-68431 CVE-2026-68451 CVE-2026-68452 CVE-2026-68480 CVE-2026-72111 CVE-2026-74440 CVE-2026-74441 CVE-2026-74442 CVE-2026-74443 CVE-2026-74444 CVE-2026-74445 CVE-2026-74446 CVE-2026-74447 CVE-2026-74448 CVE-2026-74450 CVE-2026-74451 CVE-2026-74452 CVE-2026-74453 CVE-2026-74454 CVE-2026-74455 CVE-2026-74456 CVE-2026-74457 CVE-2026-74458 CVE-2026-74459 CVE-2026-74460 CVE-2026-74461 CVE-2026-74463 CVE-2026-74464 CVE-2026-74465 CVE-2026-74467 CVE-2026-74468 CVE-2026-74469 CVE-2026-74470 CVE-2026-74471 CVE-2026-74472 CVE-2026-74473 CVE-2026-74474 CVE-2026-74475 CVE-2026-74476 CVE-2026-74478 CVE-2026-74479 CVE-2026-74480 CVE-2026-74481 CVE-2026-74482 CVE-2026-74483 CVE-2026-74484 CVE-2026-74485 CVE-2026-74487 CVE-2026-74488 CVE-2026-74490 CVE-2026-74492 CVE-2026-74493 CVE-2026-74494 CVE-2026-74495 CVE-2026-74497 CVE-2026-74498 CVE-2026-74499 CVE-2026-74500 CVE-2026-74501 CVE-2026-74502 CVE-2026-74503 CVE-2026-74504 CVE-2026-74505 CVE-2026-74507 CVE-2026-74508 CVE-2026-74509 CVE-2026-74510 CVE-2026-74512 CVE-2026-74514 CVE-2026-74515 CVE-2026-74516 CVE-2026-74517 CVE-2026-74518 CVE-2026-74519 CVE-2026-74522 CVE-2026-74523 CVE-2026-74524 CVE-2026-74525 CVE-2026-74531 CVE-2026-74532 CVE-2026-74535 CVE-2026-74536 CVE-2026-74540 CVE-2026-74541 CVE-2026-74543 CVE-2026-74545 CVE-2026-74546 CVE-2026-74547 CVE-2026-74548 CVE-2026-74549 CVE-2026-74550 CVE-2026-74551 CVE-2026-74552 CVE-2026-74553 CVE-2026-74555 CVE-2026-74556 CVE-2026-74557 CVE-2026-74563 CVE-2026-74564 CVE-2026-74565 CVE-2026-74566 CVE-2026-74567 CVE-2026-74569 CVE-2026-74572 CVE-2026-74574 CVE-2026-74575 CVE-2026-74576 CVE-2026-74577 CVE-2026-74579 CVE-2026-74580 CVE-2026-74581 CVE-2026-74582 CVE-2026-74583 CVE-2026-74585 CVE-2026-74586 CVE-2026-74587 CVE-2026-74588 CVE-2026-74589 CVE-2026-74590 CVE-2026-74592 CVE-2026-74594 CVE-2026-74595 CVE-2026-74597 CVE-2026-74598 CVE-2026-74599 CVE-2026-74601 CVE-2026-74602 CVE-2026-74603 CVE-2026-74604 CVE-2026-74606 CVE-2026-74607 CVE-2026-74608 CVE-2026-74609 CVE-2026-74610 CVE-2026-74612 CVE-2026-74613 CVE-2026-74614 CVE-2026-74615 CVE-2026-74616 CVE-2026-74618 CVE-2026-74619 CVE-2026-74620 CVE-2026-74621 CVE-2026-74622 CVE-2026-74623 CVE-2026-74624 CVE-2026-74625 CVE-2026-74628 CVE-2026-74630 CVE-2026-74631 CVE-2026-74632 CVE-2026-74634 CVE-2026-74635 CVE-2026-74636 CVE-2026-74637 CVE-2026-74641 CVE-2026-74644 CVE-2026-74646 CVE-2026-74647 CVE-2026-74648 CVE-2026-74649 CVE-2026-74650 CVE-2026-74651 CVE-2026-74654 CVE-2026-74655 CVE-2026-74656 CVE-2026-74657 CVE-2026-74658 CVE-2026-74659 CVE-2026-74660 CVE-2026-74661 CVE-2026-74663 CVE-2026-74664 CVE-2026-74665 CVE-2026-74666 CVE-2026-74667 CVE-2026-74668 CVE-2026-74669 CVE-2026-74670 CVE-2026-74671 CVE-2026-74672 CVE-2026-74673 CVE-2026-74675 CVE-2026-74676 CVE-2026-74677 CVE-2026-74678 CVE-2026-74679 CVE-2026-74680 CVE-2026-74682 CVE-2026-74683 CVE-2026-74684 CVE-2026-74685 CVE-2026-74688 CVE-2026-74689 CVE-2026-74691 CVE-2026-74692 CVE-2026-74693 CVE-2026-74694 CVE-2026-74696 CVE-2026-74700 CVE-2026-74701 CVE-2026-74704 CVE-2026-74705 CVE-2026-74710 CVE-2026-74712 CVE-2026-74714 CVE-2026-74717 CVE-2026-74718 CVE-2026-74719 CVE-2026-74720 CVE-2026-74722 CVE-2026-74724 CVE-2026-74725 CVE-2026-74726 CVE-2026-74730 CVE-2026-74732 Debian 錯誤 ： 1142912 1143545

    在 Linux 核心中發現數個弱點，這些弱點可能會導致特權提升、拒絕服務或資訊洩漏。

    針對穩定的發行版本 (trixie)，已在第 6.12.105-1 版中修復這些問題。

    建議您升級 linux 套件。

    如需有關 linux 安全性狀態的詳細資訊，請參閱其安全追蹤頁面：
    https://security-tracker.debian.org/tracker/linux

    有關 Debian 安全公告、如何將這些更新套用至您的系統以及常見問題的詳細資訊，請參閱：https://www.debian.org/security/

    郵寄清單：debian-security-announce@lists.debian.org

Tenable 已直接從 Debian 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

CentOS Linux 8.4 主機已安裝的套件會受到 TuxCare CENTOS8.4：CLSA-2026：1792979607 公告中提及的多個弱點影響。

  - 已解決 Linux 核心中的下列弱點：mrp: introduce active flags to prevent UAF when applicant uninit The caller of del_timer_sync must prevent restarting of the timer, If we have no this synchronization, there is a small probability that the cancellation will not be successful. And syzbot report the fellowing crash: ================================================================== BUG:
    KASAN: use-after-free in hlist_add_head include/linux/list.h:929 [inline] BUG: KASAN: use-after-free in enqueue_timer+0x18/0xa4 kernel/time/timer.c:605 Write at addr f9ff000024df6058 by task syz-fuzzer/2256 Pointer tag: [f9], memory tag: [fe] CPU: 1 PID: 2256 Comm: syz-fuzzer Not tainted 6.1.0-rc5-syzkaller-00008- ge01d50cbd6ee #0 Hardware name: linux,dummy-virt (DT) Call trace:
    dump_backtrace.part.0+0xe0/0xf0 arch/arm64/kernel/stacktrace.c:156 dump_backtrace arch/arm64/kernel/stacktrace.c:162 [inline] show_stack+0x18/0x40 arch/arm64/kernel/stacktrace.c:163
    __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x68/0x84 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x1a8/0x4a0 mm/kasan/report.c:395 kasan_report+0x94/0xb4 mm/kasan/report.c:495 __do_kernel_fault+0x164/0x1e0 arch/arm64/mm/fault.c:320 do_bad_area arch/arm64/mm/fault.c:473 [inline] do_tag_check_fault+0x78/0x8c arch/arm64/mm/fault.c:749 do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:825 el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:367 el1h_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:427 el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:576 hlist_add_head include/linux/list.h:929 [inline] enqueue_timer+0x18/0xa4 kernel/time/timer.c:605 mod_timer+0x14/0x20 kernel/time/timer.c:1161 mrp_periodic_timer_arm net/802/mrp.c:614 [inline] mrp_periodic_timer+0xa0/0xc0 net/802/mrp.c:627 call_timer_fn.constprop.0+0x24/0x80 kernel/time/timer.c:1474 expire_timers+0x98/0xc4 kernel/time/timer.c:1519 To fix it, we can introduce a new active flags to make sure the timer will not restart. (CVE-2022-50697)

  - 已解決 Linux 核心中的下列弱點：wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() When peer delete failed in a disconnect operation, use-after-free detected by KFENCE in below log. It is because for each vdev_id and address, it has only one struct ath10k_peer, it is allocated in ath10k_peer_map_event(). When connected to an AP, it has more than one HTT_T2H_MSG_TYPE_PEER_MAP reported from firmware, then the array peer_map of struct ath10k will be set muti-elements to the same ath10k_peer in ath10k_peer_map_event(). When peer delete failed in ath10k_sta_state(), the ath10k_peer will be free for the 1st peer id in array peer_map of struct ath10k, and then use-after-free happened for the 2nd peer id because they map to the same ath10k_peer. And clean up all peers in array peer_map for the ath10k_peer, then user-after-free disappeared peer map event log: [306.911021] wlan0: authenticate with b0:2a:43:e6:75:0e [ 306.957187] ath10k_pci 0000:01:00.0: mac vdev 0 peer create b0:2a:43:e6:75:0e (new sta) sta 1 / 32 peer 1 / 33 [ 306.957395] ath10k_pci 0000:01:00.0: htt peer map vdev 0 peer b0:2a:43:e6:75:0e id 246 [ 306.957404] ath10k_pci 0000:01:00.0: htt peer map vdev 0 peer b0:2a:43:e6:75:0e id 198 [ 306.986924] ath10k_pci 0000:01:00.0: htt peer map vdev 0 peer b0:2a:43:e6:75:0e id 166 peer unmap event log: [ 435.715691] wlan0: deauthenticating from b0:2a:43:e6:75:0e by local choice (Reason: 3=DEAUTH_LEAVING) [ 435.716802] ath10k_pci 0000:01:00.0: mac vdev 0 peer delete b0:2a:43:e6:75:0e sta ffff990e0e9c2b50 (sta gone) [ 435.717177] ath10k_pci 0000:01:00.0: htt peer unmap vdev 0 peer b0:2a:43:e6:75:0e id 246 [ 435.717186] ath10k_pci 0000:01:00.0:
    htt peer unmap vdev 0 peer b0:2a:43:e6:75:0e id 198 [ 435.717193] ath10k_pci 0000:01:00.0: htt peer unmap vdev 0 peer b0:2a:43:e6:75:0e id 166 use-after-free log: [21705.888627] wlan0: deauthenticating from d0:76:8f:82:be:75 by local choice (Reason: 3=DEAUTH_LEAVING) [21713.799910] ath10k_pci 0000:01:00.0:
    failed to delete peer d0:76:8f:82:be:75 for vdev 0: -110 [21713.799925] ath10k_pci 0000:01:00.0: found sta peer d0:76:8f:82:be:75 (ptr 0000000000000000 id 102) entry on vdev 0 after it was supposedly removed [21713.799968] ================================================================== [21713.799991] BUG:
    KFENCE: use-after-free read in ath10k_sta_state+0x265/0xb8a [ath10k_core] [21713.799991] [21713.799997] Use-after-free read at 0x00000000abe1c75e (in kfence-#69): [21713.800010] ath10k_sta_state+0x265/0xb8a [ath10k_core] [21713.800041] drv_sta_state+0x115/0x677 [mac80211] [21713.800059]
    __sta_info_destroy_part2+0xb1/0x133 [mac80211] [21713.800076] __sta_info_flush+0x11d/0x162 [mac80211] [21713.800093] ieee80211_set_disassoc+0x12d/0x2f4 [mac80211] [21713.800110] ieee80211_mgd_deauth+0x26c/0x29b [mac80211] [21713.800137] cfg80211_mlme_deauth+0x13f/0x1bb [cfg80211] [21713.800153] nl80211_deauthenticate+0xf8/0x121 [cfg80211] [21713.800161] genl_rcv_msg+0x38e/0x3be [21713.800166] netlink_rcv_skb+0x89/0xf7 [21713.800171] genl_rcv+0x28/0x36 [21713.800176] netlink_unicast+0x179/0x24b [21713.800181] netlink_sendmsg+0x3a0/0x40e [21713.800187] sock_sendmsg+0x72/0x76 [21713.800192] ____sys_sendmsg+0x16d/0x1e3 [21713.800196] ___sys_sendmsg+0x95/0xd1 [21713.800200] __sys_sendmsg+0x85/0xbf [21713.800205] do_syscall_64+0x43/0x55 [21713.800210] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [21713.800213] [21713.800219] kfence-#69:
    0x000000009149b0d5-0x000000004c0697fb, size=1064, cache=kmalloc-2k [21713.800219] [21713.800224] allocated by task 13 on cpu 0 at 21705.501373s: [21713.800241] ath10k_peer_map_event+0x7e/0x154 [ath10k_core] [21713.800254] ath10k_htt_t2h_msg_handler+0x586/0x1039 [ath10k_core] [21713.800265] ath10k_htt_htc_t2h_msg_handler+0x12/0x28 [ath10k_core] [21713.800277] ath10k_htc_rx_completion_handler+0x14c/0x1b5 [ath10k_core] [21713.800283] ath10k_pci_process_rx_cb+0x195/0x1d ---truncated--- (CVE-2022-50880)

  - 已解決 Linux 核心中的下列弱點：ubi: Fix use-after-free when volume resizing failed There is an use-after-free problem reported by KASAN:
    ================================================================== BUG: KASAN: use-after-free in ubi_eba_copy_table+0x11f/0x1c0 [ubi] Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735 CPU: 2 PID: 4735 Comm: ubirsvol Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 ubi_eba_copy_table+0x11f/0x1c0 [ubi] ubi_resize_volume+0x4f9/0xbc0 [ubi] ubi_cdev_ioctl+0x701/0x1850 [ubi] __x64_sys_ioctl+0x11d/0x170 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> When ubi_change_vtbl_record() returns an error in ubi_resize_volume(), new_eba_tbl will be freed on error handing path, but it is holded by vol->eba_tbl in ubi_eba_replace_table(). It means that the liftcycle of vol->eba_tbl and vol are different, so when resizing volume in next time, it causing an use-after-free fault. Fix it by not freeing new_eba_tbl after it replaced in ubi_eba_replace_table(), while will be freed in next volume resizing. (CVE-2023-53800)

  - 已解決 Linux 核心中的下列弱點：crypto: essiv - Handle EBUSY correctly As it is essiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. However, as the caller of essiv may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free. (CVE-2023-54046)

  - 已解決 Linux 核心中的下列弱點：net: avoid potential underflow in qdisc_pkt_len_init() with UFO After commit 7c6d2ecbda83 (net: be more gentle about silly gso requests coming from user) virtio_net_hdr_to_skb() had sanity check to detect malicious attempts from user space to cook a bad GSO packet. Then commit cf9acc90c80ec (net: virtio_net_hdr_to_skb: count transport header in UFO) while fixing one issue, allowed user space to cook a GSO packet with the following characteristic : IPv4 SKB_GSO_UDP, gso_size=3, skb->len = 28. When this packet arrives in qdisc_pkt_len_init(), we end up with hdr_len = 28 (IPv4 header + UDP header), matching skb->len Then the following sets gso_segs to 0 :
    gso_segs = DIV_ROUND_UP(skb->len - hdr_len, shinfo->gso_size); Then later we set qdisc_skb_cb(skb)->pkt_len to back to zero :/ qdisc_skb_cb(skb)->pkt_len += (gso_segs - 1) * hdr_len; This leads to the following crash in fq_codel [1] qdisc_pkt_len_init() is best effort, we only want an estimation of the bytes sent on the wire, not crashing the kernel. This patch is fixing this particular issue, a following one adds more sanity checks for another potential bug. [1] [ 70.724101] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 70.724561] #PF: supervisor read access in kernel mode [ 70.724561] #PF: error_code(0x0000) - not-present page [ 70.724561] PGD 10ac61067 P4D 10ac61067 PUD 107ee2067 PMD 0 [ 70.724561] Oops: Oops: 0000 [#1] SMP NOPTI [ 70.724561] CPU: 11 UID: 0 PID: 2163 Comm:
    b358537762 Not tainted 6.11.0-virtme #991 [ 70.724561] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.724561] RIP: 0010:fq_codel_enqueue (net/sched/sch_fq_codel.c:120 net/sched/sch_fq_codel.c:168 net/sched/sch_fq_codel.c:230) sch_fq_codel [70.724561] Code: 24 08 49 c1 e1 06 44 89 7c 24 18 45 31 ed 45 31 c0 31 ff 89 44 24 14 4c 03 8b 90 01 00 00 eb 04 39 ca 73 37 4d 8b 39 83 c7 01 <49> 8b 17 49 89 11 41 8b 57 28 45 8b 5f 34 49 c7 07 00 00 00 00 49 All code ======== 0: 24 08 and $0x8,%al 2: 49 c1 e1 06 shl $0x6,%r9 6: 44 89 7c 24 18 mov %r15d,0x18(%rsp) b: 45 31 ed xor %r13d,%r13d e: 45 31 c0 xor %r8d,%r8d 11: 31 ff xor %edi,%edi 13: 89 44 24 14 mov %eax,0x14(%rsp) 17: 4c 03 8b 90 01 00 00 add 0x190(%rbx),%r9 1e: eb 04 jmp 0x24 20: 39 ca cmp %ecx,%edx 22: 73 37 jae 0x5b 24: 4d 8b 39 mov (%r9),%r15 27: 83 c7 01 add $0x1,%edi 2a:* 49 8b 17 mov (%r15),%rdx <-- trapping instruction 2d: 49 89 11 mov %rdx,(%r9) 30: 41 8b 57 28 mov 0x28(%r15),%edx 34: 45 8b 5f 34 mov 0x34(%r15),%r11d 38: 49 c7 07 00 00 00 00 movq $0x0,(%r15) 3f: 49 rex.WB Code starting with the faulting instruction =========================================== 0: 49 8b 17 mov (%r15),%rdx 3: 49 89 11 mov %rdx,(%r9) 6: 41 8b 57 28 mov 0x28(%r15),%edx a: 45 8b 5f 34 mov 0x34(%r15),%r11d e: 49 c7 07 00 00 00 00 movq $0x0,(%r15) 15: 49 rex.WB [ 70.724561] RSP: 0018:ffff95ae85e6fb90 EFLAGS: 00000202 [ 70.724561] RAX: 0000000002000000 RBX: ffff95ae841de000 RCX: 0000000000000000 [ 70.724561] RDX: 0000000000000000 RSI:
    0000000000000001 RDI: 0000000000000001 [ 70.724561] RBP: ffff95ae85e6fbf8 R08: 0000000000000000 R09:
    ffff95b710a30000 [ 70.724561] R10: 0000000000000000 R11: bdf289445ce31881 R12: ffff95ae85e6fc58 [70.724561] R13: 0000000000000000 R14: 0000000000000040 R15: 0000000000000000 [ 70.724561] FS:
    000000002c5c1380(0000) GS:ffff95bd7fcc0000(0000) knlGS:0000000000000000 [ 70.724561] CS: 0010 DS: 0000 ES:
    0000 C ---truncated--- (CVE-2024-49949)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Debian 12 主機安裝的套件會受到 dla-4777 公告中提及的多個弱點影響。

    - Bonaccorso debian-lts@lists.debian.org------------------------------------------------------------------------- https://www.debian.org/lts/security/Salvatore Debian LTS 公告 DLA-4777-1 2026 年 9 月 8 日https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    套件：linux 版本： 6.1.187-1 CVE ID： CVE-2023-53706 CVE-2023-54141 CVE-2023-54263 CVE-2024-38620 CVE-2024-46754 CVE-2024-58094 CVE-2024-58095 CVE-2025-22104 CVE-2025-38117 CVE-2025-38203 CVE-2025-38206 CVE-2025-38237 CVE-2025-38616 CVE-2025-39833 CVE-2025-39901 CVE-2025-39925 CVE-2025-40054 CVE-2025-40064 CVE-2025-40102 CVE-2025-40139 CVE-2025-40168 CVE-2025-40206 CVE-2025-40307 CVE-2025-68794 CVE-2026-23394 CVE-2026-31419 CVE-2026-43491 CVE-2026-45963 CVE-2026-46111 CVE-2026-46158 CVE-2026-46170 CVE-2026-46266 CVE-2026-53089 CVE-2026-53090 CVE-2026-53361 CVE-2026-64082 CVE-2026-64139 CVE-2026-64192 CVE-2026-64270 CVE-2026-64272 CVE-2026-64280 CVE-2026-64294 CVE-2026-64434 CVE-2026-64507 CVE-2026-64508 CVE-2026-64542 CVE-2026-64543 CVE-2026-64561 CVE-2026-64562 CVE-2026-64563 CVE-2026-64564 CVE-2026-64565 CVE-2026-64567 CVE-2026-64569 CVE-2026-64571 CVE-2026-64572 CVE-2026-64573 CVE-2026-64576 CVE-2026-64577 CVE-2026-64578 CVE-2026-64579 CVE-2026-64580 CVE-2026-64581 CVE-2026-64582 CVE-2026-64583 CVE-2026-64584 CVE-2026-64586 CVE-2026-64590 CVE-2026-68082 CVE-2026-68093 CVE-2026-68096 CVE-2026-68099 CVE-2026-68100 CVE-2026-68104 CVE-2026-68106 CVE-2026-68108 CVE-2026-68111 CVE-2026-68115 CVE-2026-68117 CVE-2026-68121 CVE-2026-68123 CVE-2026-68124 CVE-2026-68125 CVE-2026-68127 CVE-2026-68129 CVE-2026-68130 CVE-2026-68131 CVE-2026-68132 CVE-2026-68135 CVE-2026-68136 CVE-2026-68137 CVE-2026-68138 CVE-2026-68140 CVE-2026-68141 CVE-2026-68142 CVE-2026-68143 CVE-2026-68144 CVE-2026-68146 CVE-2026-68147 CVE-2026-68148 CVE-2026-68151 CVE-2026-68153 CVE-2026-68154 CVE-2026-68155 CVE-2026-68156 CVE-2026-68157 CVE-2026-68158 CVE-2026-68159 CVE-2026-68160 CVE-2026-68162 CVE-2026-68164 CVE-2026-68165 CVE-2026-68169 CVE-2026-68175 CVE-2026-68176 CVE-2026-68180 CVE-2026-68181 CVE-2026-68182 CVE-2026-68183 CVE-2026-68184 CVE-2026-68186 CVE-2026-68187 CVE-2026-68188 CVE-2026-68189 CVE-2026-68190 CVE-2026-68192 CVE-2026-68194 CVE-2026-68195 CVE-2026-68196 CVE-2026-68197 CVE-2026-68198 CVE-2026-68199 CVE-2026-68202 CVE-2026-68204 CVE-2026-68206 CVE-2026-68207 CVE-2026-68209 CVE-2026-68210 CVE-2026-68212 CVE-2026-68213 CVE-2026-68214 CVE-2026-68215 CVE-2026-68216 CVE-2026-68217 CVE-2026-68218 CVE-2026-68222 CVE-2026-68223 CVE-2026-68226 CVE-2026-68227 CVE-2026-68229 CVE-2026-68231 CVE-2026-68234 CVE-2026-68243 CVE-2026-68244 CVE-2026-68246 CVE-2026-68248 CVE-2026-68249 CVE-2026-68250 CVE-2026-68251 CVE-2026-68253 CVE-2026-68254 CVE-2026-68255 CVE-2026-68259 CVE-2026-68269 CVE-2026-68277 CVE-2026-68278 CVE-2026-68279 CVE-2026-68280 CVE-2026-68284 CVE-2026-68294 CVE-2026-68297 CVE-2026-68299 CVE-2026-68300 CVE-2026-68301 CVE-2026-68302 CVE-2026-68304 CVE-2026-68309 CVE-2026-68310 CVE-2026-68313 CVE-2026-68315 CVE-2026-68320 CVE-2026-68322 CVE-2026-68324 CVE-2026-68325 CVE-2026-68326 CVE-2026-68327 CVE-2026-68328 CVE-2026-68331 CVE-2026-68333 CVE-2026-68335 CVE-2026-68336 CVE-2026-68338 CVE-2026-68340 CVE-2026-68343 CVE-2026-68344 CVE-2026-68349 CVE-2026-68350 CVE-2026-68351 CVE-2026-68352 CVE-2026-68353 CVE-2026-68354 CVE-2026-68355 CVE-2026-68357 CVE-2026-68359 CVE-2026-68360 CVE-2026-68361 CVE-2026-68362 CVE-2026-68363 CVE-2026-68365 CVE-2026-68366 CVE-2026-68367 CVE-2026-68368 CVE-2026-68369 CVE-2026-68370 CVE-2026-68371 CVE-2026-68373 CVE-2026-68376 CVE-2026-68377 CVE-2026-68386 CVE-2026-68388 CVE-2026-68395 CVE-2026-68397 CVE-2026-68398 CVE-2026-68402 CVE-2026-68403 CVE-2026-68405 CVE-2026-68406 CVE-2026-68407 CVE-2026-68410 CVE-2026-68411 CVE-2026-68413 CVE-2026-68414 CVE-2026-68417 CVE-2026-68422 CVE-2026-68425 CVE-2026-68427 CVE-2026-68428 CVE-2026-68430 CVE-2026-68431 CVE-2026-68432 CVE-2026-68433 CVE-2026-68434 CVE-2026-68444 CVE-2026-68446 CVE-2026-68450 CVE-2026-68451 CVE-2026-68452 CVE-2026-68476 CVE-2026-68480 CVE-2026-72012 CVE-2026-72015 CVE-2026-72017 CVE-2026-72023 CVE-2026-72030 CVE-2026-72035 CVE-2026-72040 CVE-2026-72041 CVE-2026-72045 CVE-2026-72051 CVE-2026-72057 CVE-2026-72062 CVE-2026-72063 CVE-2026-72065 CVE-2026-72069 CVE-2026-72070 CVE-2026-72077 CVE-2026-72096 CVE-2026-72099 CVE-2026-72110 CVE-2026-72113 CVE-2026-72114 CVE-2026-72115 CVE-2026-72116 CVE-2026-72117 CVE-2026-72118 CVE-2026-72119 CVE-2026-72121 CVE-2026-72124 CVE-2026-72125 CVE-2026-72142 CVE-2026-72146 CVE-2026-72157 CVE-2026-72170 CVE-2026-72172 CVE-2026-72191 CVE-2026-72216 CVE-2026-72236 CVE-2026-72237 CVE-2026-72242 CVE-2026-72252 CVE-2026-72253 CVE-2026-72260 CVE-2026-72262 CVE-2026-72299 CVE-2026-72305 CVE-2026-72308 CVE-2026-72323 CVE-2026-72392 CVE-2026-74436 CVE-2026-74441 CVE-2026-74443 CVE-2026-74444 CVE-2026-74446 CVE-2026-74450 CVE-2026-74453 CVE-2026-74454 CVE-2026-74455 CVE-2026-74456 CVE-2026-74457 CVE-2026-74458 CVE-2026-74459 CVE-2026-74460 CVE-2026-74461 CVE-2026-74463 CVE-2026-74464 CVE-2026-74465 CVE-2026-74467 CVE-2026-74468 CVE-2026-74469 CVE-2026-74470 CVE-2026-74471 CVE-2026-74472 CVE-2026-74473 CVE-2026-74475 CVE-2026-74476 CVE-2026-74478 CVE-2026-74479 CVE-2026-74480 CVE-2026-74481 CVE-2026-74482 CVE-2026-74485 CVE-2026-74487 CVE-2026-74488 CVE-2026-74490 CVE-2026-74492 CVE-2026-74493 CVE-2026-74494 CVE-2026-74495 CVE-2026-74497 CVE-2026-74498 CVE-2026-74499 CVE-2026-74505 CVE-2026-74507 CVE-2026-74508 CVE-2026-74509 CVE-2026-74510 CVE-2026-74512 CVE-2026-74514 CVE-2026-74515 CVE-2026-74516 CVE-2026-74518 CVE-2026-74519 CVE-2026-74522 CVE-2026-74523 CVE-2026-74525 CVE-2026-74540 CVE-2026-74546 CVE-2026-74547 CVE-2026-74548 CVE-2026-74549 CVE-2026-74550 CVE-2026-74551 CVE-2026-74552 CVE-2026-74553 CVE-2026-74555 CVE-2026-74556 CVE-2026-74557 CVE-2026-74563 CVE-2026-74564 CVE-2026-74566 CVE-2026-74567 CVE-2026-74569 CVE-2026-74575 CVE-2026-74577 CVE-2026-74579 CVE-2026-74580 CVE-2026-74581 CVE-2026-74582 CVE-2026-74583 CVE-2026-74585 CVE-2026-74586 CVE-2026-74587 CVE-2026-74588 CVE-2026-74589 CVE-2026-74594 CVE-2026-74595 CVE-2026-74597 CVE-2026-74598 CVE-2026-74601 CVE-2026-74603 CVE-2026-74604 CVE-2026-74607 CVE-2026-74608 CVE-2026-74609 CVE-2026-74612 CVE-2026-74613 CVE-2026-74614 CVE-2026-74615 CVE-2026-74616 CVE-2026-74620 CVE-2026-74621 CVE-2026-74622 CVE-2026-74623 CVE-2026-74624 CVE-2026-74625 CVE-2026-74626 CVE-2026-74628 CVE-2026-74630 CVE-2026-74631 CVE-2026-74632 CVE-2026-74635 CVE-2026-74636 CVE-2026-74637 CVE-2026-74641 CVE-2026-74647 CVE-2026-74648 CVE-2026-74649 CVE-2026-74650 CVE-2026-74651 CVE-2026-74654 CVE-2026-74656 CVE-2026-74657 CVE-2026-74658 CVE-2026-74659 CVE-2026-74660 CVE-2026-74662 CVE-2026-74663 CVE-2026-74664 CVE-2026-74666 CVE-2026-74667 CVE-2026-74668 CVE-2026-74669 CVE-2026-74671 CVE-2026-74672 CVE-2026-74673 CVE-2026-74675 CVE-2026-74676 CVE-2026-74678 CVE-2026-74679 CVE-2026-74680 CVE-2026-74682 CVE-2026-74683 CVE-2026-74688 CVE-2026-74689 CVE-2026-74691 CVE-2026-74692 CVE-2026-74693 CVE-2026-74694 CVE-2026-74696 CVE-2026-74697 CVE-2026-74701 CVE-2026-74704 CVE-2026-74705 CVE-2026-74714 CVE-2026-74717 CVE-2026-74719 CVE-2026-74720 CVE-2026-74722 CVE-2026-74724 CVE-2026-74726 CVE-2026-74730 CVE-2026-74737 CVE-2026-74739 CVE-2026-74743 CVE-2026-74744 CVE-2026-74746 CVE-2026-74748 CVE-2026-80527 CVE-2026-80528 CVE-2026-80529 CVE-2026-80534 CVE-2026-80536 CVE-2026-80539 CVE-2026-80540 CVE-2026-80541 CVE-2026-80547 CVE-2026-80548 CVE-2026-80549 CVE-2026-80550 CVE-2026-80552 CVE-2026-80553 CVE-2026-80555 CVE-2026-80557 CVE-2026-80558 CVE-2026-80559 CVE-2026-80560 CVE-2026-80561 CVE-2026-80562 CVE-2026-80565 CVE-2026-80567 CVE-2026-80568 CVE-2026-80569 CVE-2026-80570 CVE-2026-80572 CVE-2026-80573 CVE-2026-80574 CVE-2026-80583 CVE-2026-80584 CVE-2026-80586 CVE-2026-80589 CVE-2026-80590 CVE-2026-80678 CVE-2026-80679 CVE-2026-80680 CVE-2026-80681 CVE-2026-80684 CVE-2026-80686 CVE-2026-80706 CVE-2026-80707 CVE-2026-80708 CVE-2026-80709 CVE-2026-80714 CVE-2026-80715 CVE-2026-80716 CVE-2026-80717 CVE-2026-80718 CVE-2026-80722 CVE-2026-80725 CVE-2026-80726 CVE-2026-80730 CVE-2026-80731 CVE-2026-80732 CVE-2026-80733 CVE-2026-80737 CVE-2026-80742 CVE-2026-80743 CVE-2026-80744 CVE-2026-80752 CVE-2026-80754 CVE-2026-80756 CVE-2026-80757 CVE-2026-80762 CVE-2026-80763 CVE-2026-80764 CVE-2026-80765 CVE-2026-80766 CVE-2026-80767 CVE-2026-80768 CVE-2026-80770 CVE-2026-80772 CVE-2026-80781 CVE-2026-80782 CVE-2026-80783 CVE-2026-80784 CVE-2026-80788 CVE-2026-80789 CVE-2026-80790 CVE-2026-80791 CVE-2026-80792 CVE-2026-80793 CVE-2026-80794 CVE-2026-80795 CVE-2026-80796 CVE-2026-80797 CVE-2026-80798 CVE-2026-80799 CVE-2026-80800 CVE-2026-80801 CVE-2026-80802 CVE-2026-80803 CVE-2026-80805 CVE-2026-80806 CVE-2026-80807 CVE-2026-80808 CVE-2026-80809 CVE-2026-80812 CVE-2026-80814 CVE-2026-80819 CVE-2026-80823 CVE-2026-80824 CVE-2026-80826 CVE-2026-80827 CVE-2026-80828 CVE-2026-80829 CVE-2026-80830 CVE-2026-80831 CVE-2026-80832 CVE-2026-80840 CVE-2026-80842 CVE-2026-80843 CVE-2026-80844 CVE-2026-80846 CVE-2026-80848 CVE-2026-80852 CVE-2026-80854 CVE-2026-80855 CVE-2026-80856 CVE-2026-80863 CVE-2026-80888 CVE-2026-80890 CVE-2026-80891 CVE-2026-80892 CVE-2026-80893 CVE-2026-80901 CVE-2026-80902 CVE-2026-80904 CVE-2026-80906 CVE-2026-80908 CVE-2026-80909 CVE-2026-80910 CVE-2026-80913

    在 Linux 核心中發現數個弱點，這些弱點可能會導致特權提升、拒絕服務或資訊洩漏。

    對於 Debian 12 書蟲來說，這些問題已經在版本 6.1.187-1中修復了。

    建議您升級 linux 套件。

    如需有關 linux 安全性狀態的詳細資訊，請參閱其安全追蹤頁面：
    https://security-tracker.debian.org/tracker/linux

    有關 Debian LTS 安全公告、如何將這些更新套用至您的系統以及常見問題的詳細資訊，請參閱 : https://wiki.debian.org/LTS

Tenable 已直接從 Debian 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

ID	名稱	產品	系列	已發布	已更新	嚴重性
364137	Oracle Linux 10 / 9：Unbreakable Enterprise 核心 (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	2026/10/8	2026/10/8	high
366778	AlmaLinux 9.2 [TuxCare] 安全性更新：bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc 多個弱點（ALMALINUX9.2：CLSA-2026：1792243434）	Nessus	Alma Linux Local Security Checks	2026/10/17	2026/10/27	medium
369491	Rocky Linux 9.6 [TuxCare] 安全性更新：kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc 多個漏洞（ALMALINUX9.6：CLSA-2026：1792445930）	Nessus	Rocky Linux Local Security Checks	2026/10/21	2026/10/21	high
348574	Debian dla-4788 ： ata-modules-6.12.100+deb12-armmp-di - 安全性更新	Nessus	Debian Local Security Checks	2026/9/21	2026/9/21	medium
369490	AlmaLinux 9.6 [TuxCare] 安全性更新：kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc 多個弱點（ALMALINUX9.6：CLSA-2026：1792445930）	Nessus	Alma Linux Local Security Checks	2026/10/21	2026/10/21	high
365457	Ubuntu 24.04 LTS：Linux 核心 (NVIDIA Tegra) 弱點 (USN-8886-1)	Nessus	Ubuntu Local Security Checks	2026/10/13	2026/10/13	high
371988	CentOS Linux 8.5 [TuxCare] 安全性更新：bpftool / kernel / kernel-core / kernel-cross-headers / etc多個弱點（CENTOS8.5：CLSA-2026：1792979985）	Nessus	CentOS Local Security Checks	2026/10/26	2026/11/2	high
335814	Linux Distros 未修補弱點：CVE-2026-74450	Nessus	Misc.	2026/8/15	2026/11/6	high
339550	Debian dsa-6466 ： ata-modules-6.12.101+deb13-armmp-di - 安全性更新	Nessus	Debian Local Security Checks	2026/8/25	2026/8/29	medium
372044	CentOS Linux 8.4 [TuxCare] 安全性更新：bpftool / kernel / kernel-core / kernel-cross-headers / etc 多個弱點（CENTOS8.4：CLSA-2026：1792979607）	Nessus	CentOS Local Security Checks	2026/10/26	2026/11/2	high
343851	Debian dla-4777 ： ata-modules-6.1.0-52-armmp-di - 安全性更新	Nessus	Debian Local Security Checks	2026/9/8	2026/9/8	high

偵測

搜尋 Plugin

high

medium

high

medium

high

high

high

high

medium

high

high