In the Linux kernel, the following vulnerability has been resolved: skbuff: Fix a race between coalescing and releasing SKBs Commit 1effe8ca4e34 ("skbuff: fix coalescing for page_pool fragment recycling") allowed coalescing to proceed with non page pool page and page pool page when @from is cloned, i.e. to->pp_recycle --> false from->pp_recycle --> true skb_cloned(from) --> true However, it actually requires skb_cloned(@from) to hold true until coalescing finishes in this situation. If the other cloned SKB is released while the merging is in process, from_shinfo->nr_frags will be set to 0 toward the end of the function, causing the increment of frag page _refcount to be unexpectedly skipped resulting in inconsistent reference counts. Later when SKB(@to) is released, it frees the page directly even though the page pool page is still in use, leading to use-after-free or double-free errors. So it should be prohibited. The double-free error message below prompted us to investigate: BUG: Bad page state in process swapper/1 pfn:0e0d1 page:00000000c6548b28 refcount:-1 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0xe0d1 flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) raw: 000fffffc0000000 0000000000000000 ffffffff00000101 0000000000000000 raw: 0000000000000002 0000000000000000 ffffffffffffffff 0000000000000000 page dumped because: nonzero _refcount CPU: 1 PID: 0 Comm: swapper/1 Tainted: G E 6.2.0+ Call Trace: <IRQ> dump_stack_lvl+0x32/0x50 bad_page+0x69/0xf0 free_pcp_prepare+0x260/0x2f0 free_unref_page+0x20/0x1c0 skb_release_data+0x10b/0x1a0 napi_consume_skb+0x56/0x150 net_rx_action+0xf0/0x350 ? __napi_schedule+0x79/0x90 __do_softirq+0xc8/0x2b1 __irq_exit_rcu+0xb9/0xf0 common_interrupt+0x82/0xa0 </IRQ> <TASK> asm_common_interrupt+0x22/0x40 RIP: 0010:default_idle+0xb/0x20

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013513 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: Fix a race between coalescing and releasing SKBs

    Commit 1effe8ca4e34 (skbuff: fix coalescing for page_pool fragment     recycling) allowed coalescing to proceed with non page pool page and page     pool page when @from is cloned, i.e.

    to->pp_recycle    --> false     from->pp_recycle  --> true     skb_cloned(from)  --> true

    However, it actually requires skb_cloned(@from) to hold true until     coalescing finishes in this situation. If the other cloned SKB is     released while the merging is in process, from_shinfo->nr_frags will be     set to 0 toward the end of the function, causing the increment of frag     page _refcount to be unexpectedly skipped resulting in inconsistent     reference counts. Later when SKB(@to) is released, it frees the page     directly even though the page pool page is still in use, leading to     use-after-free or double-free errors. So it should be prohibited.

    The double-free error message below prompted us to investigate:
    BUG: Bad page state in process swapper/1  pfn:0e0d1     page:00000000c6548b28 refcount:-1 mapcount:0 mapping:0000000000000000     index:0x2 pfn:0xe0d1     flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)     raw: 000fffffc0000000 0000000000000000 ffffffff00000101 0000000000000000     raw: 0000000000000002 0000000000000000 ffffffffffffffff 0000000000000000     page dumped because: nonzero _refcount

    CPU: 1 PID: 0 Comm: swapper/1 Tainted: G            E      6.2.0+     Call Trace:
     <IRQ>     dump_stack_lvl+0x32/0x50     bad_page+0x69/0xf0     free_pcp_prepare+0x260/0x2f0     free_unref_page+0x20/0x1c0     skb_release_data+0x10b/0x1a0     napi_consume_skb+0x56/0x150     net_rx_action+0xf0/0x350     ? __napi_schedule+0x79/0x90
    __do_softirq+0xc8/0x2b1
    __irq_exit_rcu+0xb9/0xf0     common_interrupt+0x82/0xa0     </IRQ>     <TASK>     asm_common_interrupt+0x22/0x40     RIP: 0010:default_idle+0xb/0x20

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011255 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: Fix a race between coalescing and releasing SKBs

    Commit 1effe8ca4e34 (skbuff: fix coalescing for page_pool fragment     recycling) allowed coalescing to proceed with non page pool page and page     pool page when @from is cloned, i.e.

    to->pp_recycle    --> false     from->pp_recycle  --> true     skb_cloned(from)  --> true

    However, it actually requires skb_cloned(@from) to hold true until     coalescing finishes in this situation. If the other cloned SKB is     released while the merging is in process, from_shinfo->nr_frags will be     set to 0 toward the end of the function, causing the increment of frag     page _refcount to be unexpectedly skipped resulting in inconsistent     reference counts. Later when SKB(@to) is released, it frees the page     directly even though the page pool page is still in use, leading to     use-after-free or double-free errors. So it should be prohibited.

    The double-free error message below prompted us to investigate:
    BUG: Bad page state in process swapper/1  pfn:0e0d1     page:00000000c6548b28 refcount:-1 mapcount:0 mapping:0000000000000000     index:0x2 pfn:0xe0d1     flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)     raw: 000fffffc0000000 0000000000000000 ffffffff00000101 0000000000000000     raw: 0000000000000002 0000000000000000 ffffffffffffffff 0000000000000000     page dumped because: nonzero _refcount

    CPU: 1 PID: 0 Comm: swapper/1 Tainted: G            E      6.2.0+     Call Trace:
     <IRQ>     dump_stack_lvl+0x32/0x50     bad_page+0x69/0xf0     free_pcp_prepare+0x260/0x2f0     free_unref_page+0x20/0x1c0     skb_release_data+0x10b/0x1a0     napi_consume_skb+0x56/0x150     net_rx_action+0xf0/0x350     ? __napi_schedule+0x79/0x90
    __do_softirq+0xc8/0x2b1
    __irq_exit_rcu+0xb9/0xf0     common_interrupt+0x82/0xa0     </IRQ>     <TASK>     asm_common_interrupt+0x22/0x40     RIP: 0010:default_idle+0xb/0x20

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:17896 advisory.

    This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the     code of a running kernel.  This patch module is targeted for kernel-5.14.0-284.79.1.el9_2.

    Security Fix(es):

    * kernel: skbuff: Fix a race between coalescing and releasing SKBs (CVE-2023-53186)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:17734 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CVE-2025-37823)

    * kernel: net_sched: ets: Fix double list add in class with netem as child qdisc (CVE-2025-37914)

    * kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (CVE-2022-50087)

    * kernel: do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498)

    * kernel: skbuff: Fix a race between coalescing and releasing SKBs (CVE-2023-53186)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: skbuff: Fix a race between coalescing     and releasing SKBs Commit 1effe8ca4e34 (skbuff: fix coalescing for page_pool fragment recycling) allowed     coalescing to proceed with non page pool page and page pool page when @from is cloned, i.e. to->pp_recycle
    --> false from->pp_recycle --> true skb_cloned(from) --> true However, it actually requires     skb_cloned(@from) to hold true until coalescing finishes in this situation. If the other cloned SKB is     released while the merging is in process, from_shinfo->nr_frags will be set to 0 toward the end of the     function, causing the increment of frag page _refcount to be unexpectedly skipped resulting in     inconsistent reference counts. Later when SKB(@to) is released, it frees the page directly even though the     page pool page is still in use, leading to use-after-free or double-free errors. So it should be     prohibited. The double-free error message below prompted us to investigate: BUG: Bad page state in process     swapper/1 pfn:0e0d1 page:00000000c6548b28 refcount:-1 mapcount:0 mapping:0000000000000000 index:0x2     pfn:0xe0d1 flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) raw: 000fffffc0000000     0000000000000000 ffffffff00000101 0000000000000000 raw: 0000000000000002 0000000000000000 ffffffffffffffff     0000000000000000 page dumped because: nonzero _refcount CPU: 1 PID: 0 Comm: swapper/1 Tainted: G E 6.2.0+     Call Trace: <IRQ> dump_stack_lvl+0x32/0x50 bad_page+0x69/0xf0 free_pcp_prepare+0x260/0x2f0     free_unref_page+0x20/0x1c0 skb_release_data+0x10b/0x1a0 napi_consume_skb+0x56/0x150     net_rx_action+0xf0/0x350 ? __napi_schedule+0x79/0x90 __do_softirq+0xc8/0x2b1 __irq_exit_rcu+0xb9/0xf0     common_interrupt+0x82/0xa0 </IRQ> <TASK> asm_common_interrupt+0x22/0x40 RIP: 0010:default_idle+0xb/0x20     (CVE-2023-53186)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-169 advisory.

    An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores     an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system. (CVE-2023-2124)

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: Fix a race between coalescing and releasing SKBs (CVE-2023-53186)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix race on port output (CVE-2023-53188)

    In the Linux kernel, the following vulnerability has been resolved:

    raw: Fix NULL deref in raw_get_next(). (CVE-2023-53198)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: call op_release, even when op_func returns an error (CVE-2023-53241)

    In the Linux kernel, the following vulnerability has been resolved:

    Drivers: vmbus: Check for channel allocation before looking up relids (CVE-2023-53273)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: check send stream number after wait_for_sndbuf (CVE-2023-53296)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix a potential overflow in sctp_ifwdtsn_skip (CVE-2023-53372)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Free error logs of tracing instances (CVE-2023-53375)

    In the Linux kernel, the following vulnerability has been resolved:

    cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex (CVE-2023-53522)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/cma: Allow UD qp_type to join multicast only (CVE-2023-53525)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() (CVE-2023-53623)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, arm64: Fixed a BTI error on returning to patched function (CVE-2023-53634)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL (CVE-2023-53680)

    In the Linux kernel, the following vulnerability has been resolved:

    netlink: annotate lockless accesses to nlk->max_recvmsg_len (CVE-2023-53824)

    In the Linux kernel, the following vulnerability has been resolved:

    ping: Fix potentail NULL deref for /proc/net/icmp. (CVE-2023-53987)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/core: Fix GID entry ref leak when create_ah fails (CVE-2023-54003)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring: fix memory leak when removing provided buffers (CVE-2023-54041)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: drop peer group ids under namespace lock (CVE-2023-54128)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: stricter state check in mptcp_worker (CVE-2023-54176)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: fix race condition UAF in i915_perf_add_config_ioctl (CVE-2023-54202)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix an uninit variable access bug in __ip6_make_skb() (CVE-2023-54265)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.108-65.141. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-017 advisory.

    An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores     an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system. (CVE-2023-2124)

    In the Linux kernel, the following vulnerability has been resolved:

    skbuff: Fix a race between coalescing and releasing SKBs (CVE-2023-53186)

    In the Linux kernel, the following vulnerability has been resolved:

    Drivers: vmbus: Check for channel allocation before looking up relids (CVE-2023-53273)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: check send stream number after wait_for_sndbuf (CVE-2023-53296)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix a potential overflow in sctp_ifwdtsn_skip (CVE-2023-53372)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Free error logs of tracing instances (CVE-2023-53375)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/cma: Allow UD qp_type to join multicast only (CVE-2023-53525)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() (CVE-2023-53623)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL (CVE-2023-53680)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/core: Fix GID entry ref leak when create_ah fails (CVE-2023-54003)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: drop peer group ids under namespace lock (CVE-2023-54128)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: stricter state check in mptcp_worker (CVE-2023-54176)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: fix race condition UAF in i915_perf_add_config_ioctl (CVE-2023-54202)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix an uninit variable access bug in __ip6_make_skb() (CVE-2023-54265)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
309363	Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013513)	Nessus	Unity Linux Local Security Checks	medium
308437	Unity Linux 20.1070e Security Update: kernel (UTSA-2026-011255)	Nessus	Unity Linux Local Security Checks	medium
301628	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1280)	Nessus	Huawei Local Security Checks	high
301595	EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1244)	Nessus	Huawei Local Security Checks	high
270338	RHEL 9 : kpatch-patch-5_14_0-284_104_1, kpatch-patch-5_14_0-284_117_1, kpatch-patch-5_14_0-284_134_1, kpatch-patch-5_14_0-284_79_1, and kpatch-patch-5_14_0-284_92_1 (RHSA-2025:17896)	Nessus	Red Hat Local Security Checks	high
270112	RHEL 9 : kernel (RHSA-2025:17734)	Nessus	Red Hat Local Security Checks	high
264929	Linux Distros Unpatched Vulnerability : CVE-2023-53186	Nessus	Misc.	medium
175085	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-169)	Nessus	Amazon Linux Local Security Checks	high
174975	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-017 (ALASKERNEL-5.15-2023-017)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2023-53186

medium

Tenable Plugins

medium

medium

high

high

high

high

medium

high

high