In the Linux kernel, the following vulnerability has been resolved: hwrng: geode - Fix PCI device refcount leak for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the returned pci_dev and also decrease the reference count for the input pci_dev @from if it is not NULL. If we break for_each_pci_dev() loop with pdev not NULL, we need to call pci_dev_put() to decrease the reference count. We add a new struct 'amd_geode_priv' to record pointer of the pci_dev and membase, and then add missing pci_dev_put() for the normal and error path.

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1792975902 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: hwrng: geode - Fix PCI device refcount     leak for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it     will increase the reference count for the returned pci_dev and also decrease the reference count for the     input pci_dev @from if it is not NULL. If we break for_each_pci_dev() loop with pdev not NULL, we need to     call pci_dev_put() to decrease the reference count. We add a new struct 'amd_geode_priv' to record pointer     of the pci_dev and membase, and then add missing pci_dev_put() for the normal and error path.
    (CVE-2022-50659)

  - In the Linux kernel, the following vulnerability has been resolved: ubi: Fix use-after-free when volume     resizing failed There is an use-after-free problem reported by KASAN:
    ================================================================== BUG: KASAN: use-after-free in     ubi_eba_copy_table+0x11f/0x1c0 [ubi] Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735 CPU: 2     PID: 4735 Comm: ubirsvol Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14 Hardware name: QEMU Standard     PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44     print_report+0x171/0x472 kasan_report+0xad/0x130 ubi_eba_copy_table+0x11f/0x1c0 [ubi]     ubi_resize_volume+0x4f9/0xbc0 [ubi] ubi_cdev_ioctl+0x701/0x1850 [ubi] __x64_sys_ioctl+0x11d/0x170     do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> When ubi_change_vtbl_record()     returns an error in ubi_resize_volume(), new_eba_tbl will be freed on error handing path, but it is     holded by vol->eba_tbl in ubi_eba_replace_table(). It means that the liftcycle of vol->eba_tbl and     vol are different, so when resizing volume in next time, it causing an use-after-free fault. Fix it by     not freeing new_eba_tbl after it replaced in ubi_eba_replace_table(), while will be freed in next volume     resizing. (CVE-2023-53800)

  - In the Linux kernel, the following vulnerability has been resolved: media: av7110: prevent underflow in     write_ts_to_decoder() The buf[4] value comes from the user via ts_play(). It is a value in the u8 range.
    The final length we pass to av7110_ipack_instant_repack() is len - (buf[4] + 1) - 4 so add a check to     ensure that the length is not negative. It's not clear that passing a negative len value does anything bad     necessarily, but it's not best practice. With the new bounds checking the if (!len) condition is no     longer possible or required so remove that. (CVE-2023-54284)

  - In the Linux kernel, the following vulnerability has been resolved: ext4: fix dirtyclusters double     decrement on fs shutdown fstests test generic/388 occasionally reproduces a warning in ext4_put_super()     associated with the dirty clusters count: WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324     ext4_put_super+0x48c/0x590 [ext4] Tracing the failure shows that the warning fires due to an     s_dirtyclusters_counter value of -1. IOW, this appears to be a spurious decrement as opposed to some sort     of leak. Further tracing of the dirty cluster count deltas and an LLM scan of the resulting output     identified the cause as a double decrement in the error path between ext4_mb_mark_diskspace_used() and the     caller ext4_mb_new_blocks(). First, note that generic/388 is a shutdown vs. fsstress test and so produces     a random set of operations and shutdown injections. In the problematic case, the shutdown triggers an     error return from the ext4_handle_dirty_metadata() call(s) made from ext4_mb_mark_context(). The changed     value is non-zero at this point, so ext4_mb_mark_diskspace_used() does not exit after the error bubbles up     from ext4_mb_mark_context(). Instead, the former decrements both cluster counters and returns the error up     to ext4_mb_new_blocks(). The latter falls into the !ar->len out path which decrements the dirty clusters     counter a second time, creating the inconsistency. To avoid this problem and simplify ownership of the     cluster reservation in this codepath, lift the counter reduction to a single place in the caller. This     makes it more clear that ext4_mb_new_blocks() is responsible for acquiring cluster reservation (via     ext4_claim_free_clusters()) in the !delalloc case as well as releasing it, regardless of whether it ends     up consumed or returned due to failure. (CVE-2026-45920)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: b43: enforce bounds check on     firmware key index in b43_rx() The firmware-controlled key index in b43_rx() can exceed the dev->key[]     array size (58 entries). The existing B43_WARN_ON is non-enforcing in production builds, allowing an out-     of-bounds read. Make the B43_WARN_ON check enforcing by dropping the frame when the firmware returns an     invalid key index. (CVE-2026-46122)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013795 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    hwrng: geode - Fix PCI device refcount leak

    for_each_pci_dev() is implemented by pci_get_device(). The comment of     pci_get_device() says that it will increase the reference count for the     returned pci_dev and also decrease the reference count for the input     pci_dev @from if it is not NULL.

    If we break for_each_pci_dev() loop with pdev not NULL, we need to call     pci_dev_put() to decrease the reference count. We add a new struct     'amd_geode_priv' to record pointer of the pci_dev and membase, and then     add missing pci_dev_put() for the normal and error path.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010805 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    hwrng: geode - Fix PCI device refcount leak

    for_each_pci_dev() is implemented by pci_get_device(). The comment of     pci_get_device() says that it will increase the reference count for the     returned pci_dev and also decrease the reference count for the input     pci_dev @from if it is not NULL.

    If we break for_each_pci_dev() loop with pdev not NULL, we need to call     pci_dev_put() to decrease the reference count. We add a new struct     'amd_geode_priv' to record pointer of the pci_dev and membase, and then     add missing pci_dev_put() for the normal and error path.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - hwrng: geode - Fix PCI device refcount leak for_each_pci_dev() is implemented by pci_get_device(). The     comment of pci_get_device() says that it will increase the reference count for the returned pci_dev and     also decrease the reference count for the input pci_dev @from if it is not NULL. If we break     for_each_pci_dev() loop with pdev not NULL, we need to call pci_dev_put() to decrease the reference count.
    We add a new struct 'amd_geode_priv' to record pointer of the pci_dev and membase, and then add missing     pci_dev_put() for the normal and error path. (CVE-2022-50659)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

ID	Name	Product	Family	Type	Severity
373891	CentOS Linux 6 [TuxCare] Security Update: kernel / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1792975902)	Nessus	CentOS Local Security Checks	Local	high
309469	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013795)	Nessus	Unity Linux Local Security Checks	Local	medium
309025	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010805)	Nessus	Unity Linux Local Security Checks	Local	medium
278317	Linux Distros Unpatched Vulnerability : CVE-2022-50659	Nessus	Misc.	Local	medium
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2022-50659

medium

Tenable Plugins

high

medium

medium

medium

high