In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: dropping parent refcount after pd_free_fn() is done Some cgroup policies will access parent pd through child pd even after pd_offline_fn() is done. If pd_free_fn() for parent is called before child, then UAF can be triggered. Hence it's better to guarantee the order of pd_free_fn(). Currently refcount of parent blkg is dropped in __blkg_release(), which is before pd_free_fn() is called in blkg_free_work_fn() while blkg_free_work_fn() is called asynchronously. This patch make sure pd_free_fn() called from removing cgroup is ordered by delaying dropping parent refcount after calling pd_free_fn() for child. BTW, pd_free_fn() will also be called from blkcg_deactivate_policy() from deleting device, and following patches will guarantee the order.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1794643812 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz     capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every     band if 6 GHz is supported, so add the size to scan_ies_len. Otherwise, building probe request elements     can fail, triggering the WARN_ON in __ieee80211_start_scan(). (CVE-2026-98328)

  - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix issue in verifying     allow_ptr_leaks After we converted the capabilities of our networking-bpf program from cap_sys_admin to     cap_net_admin+cap_bpf, our networking-bpf program failed to start. Because it failed the bpf verifier, and     the error log is R3 pointer comparison prohibited. A simple reproducer as follows, SEC(cls-ingress)     int ingress(struct __sk_buff *skb) { struct iphdr *iph = (void *)(long)skb->data + sizeof(struct ethhdr);
    if ((long)(iph + 1) > (long)skb->data_end) return TC_ACT_STOLEN; return TC_ACT_OK; } Per discussion with     Yonghong and Alexei [1], comparison of two packet pointers is not a pointer leak. This patch fixes it. Our     local kernel is 6.1.y and we expect this fix to be backported to 6.1.y, so stable is CCed. [1].
    https://lore.kernel.org/bpf/CAADnVQ+Nmspr7Si+pxWn8zkE7hX-7s93ugwC+94aXSy4uQ9vBg@mail.gmail.com/     (CVE-2023-54181)

  - In the Linux kernel, the following vulnerability has been resolved: driver core: Avoid warning when     removing a device while its supplier is unbinding During driver removal, the following warning can appear:
    WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 __device_links_no_driver+0xcc/0xfc ... Call trace:
    __device_links_no_driver+0xcc/0xfc (P) device_links_driver_cleanup+0xa8/0xf0     device_release_driver_internal+0x208/0x23c device_links_unbind_consumers+0xe0/0x108     device_release_driver_internal+0xec/0x23c device_links_unbind_consumers+0xe0/0x108     device_release_driver_internal+0xec/0x23c device_links_unbind_consumers+0xe0/0x108     device_release_driver_internal+0xec/0x23c driver_detach+0xa0/0x12c bus_remove_driver+0x6c/0xbc     driver_unregister+0x30/0x60 pci_unregister_driver+0x20/0x9c lan966x_pci_driver_exit+0x18/0xa90     [lan966x_pci] This warning is triggered when a consumer is removed because the links status of its     supplier is not DL_DEV_DRIVER_BOUND and the link flag DL_FLAG_SYNC_STATE_ONLY is not set. The topology in     terms of consumers/suppliers used was the following (consumer ---> supplier): i2c -----------> OIC ---->     PCI device | ^ | | +---> pinctrl ---+ When the PCI device is removed, the OIC (interrupt controller) has     to be removed. In order to remove the OIC, pinctrl and i2c need to be removed and to remove pinctrl, i2c     need to be removed. The removal order is: 1) i2c 2) pinctrl 3) OIC 4) PCI device In details, the removal     sequence is the following (with 0000:01:00.0 the PCI device): driver_detach: call     device_release_driver_internal(0000:01:00.0)... device_links_busy(0000:01:00.0): links->status =     DL_DEV_UNBINDING device_links_unbind_consumers(0000:01:00.0): 0000:01:00.0--oic link->status =     DL_STATE_SUPPLIER_UNBIND call device_release_driver_internal(oic)... device_links_busy(oic): links->status     = DL_DEV_UNBINDING device_links_unbind_consumers(oic): oic--pinctrl link->status =     DL_STATE_SUPPLIER_UNBIND call device_release_driver_internal(pinctrl)... device_links_busy(pinctrl):
    links->status = DL_DEV_UNBINDING device_links_unbind_consumers(pinctrl): pinctrl--i2c link->status =     DL_STATE_SUPPLIER_UNBIND call device_release_driver_internal(i2c)... device_links_busy(i2c): links->status     = DL_DEV_UNBINDING __device_links_no_driver(i2c)... pinctrl--i2c link->status is DL_STATE_SUPPLIER_UNBIND     oic--i2c link->status is DL_STATE_ACTIVE oic--i2c link->supplier->links.status is DL_DEV_UNBINDING The     warning is triggered by the i2c removal because the OIC (supplier) links status is not     DL_DEV_DRIVER_BOUND. Its links status is indeed set to DL_DEV_UNBINDING. It is perfectly legit to have the     links status set to DL_DEV_UNBINDING in that case. Indeed we had started to unbind the OIC which triggered     the consumer unbinding and didn't finish yet when the i2c is unbound. Avoid the warning when the supplier     links status is set to DL_DEV_UNBINDING and thus support this removal sequence without any warnings.
    (CVE-2026-97479)

  - In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB     altmode array index The UCSI displayport driver indexes the connector's port altmode array with the     GET_CURRENT_CAM response after checking it is not 0xff. The port altmode array is UCSI_MAX_ALTMODES     elements long. If the PPM returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and not     equal to 0xff, the kernel may crash with an array index OOB error. Update the UCSI displayport driver to     verify the current cam is less than UCSI_MAX_ALTMODES before accessing the port altmode array.
    (CVE-2026-90025)

  - In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: fix layout segment leak on     the pnfs_layout_process() forget path When the server returns a new layout stateid while a valid one is     still held, pnfs_layout_process() calls pnfs_mark_matching_lsegs_return() on the on-stack free_me list and     jumps to out_forget. Segments whose reference count drops to zero are unlinked from lo->plh_segs and moved     to free_me by mark_lseg_invalid(); for an idle cached segment the layout header holds the only reference,     so this happens on the first decrement. out_forget never drains free_me -- only the success path calls     pnfs_free_lseg_list(). Commit 814b84971388 (pNFS/NFSv4: Fix a layout segment leak in     pnfs_layout_process()) added the drain; commit 08bd8dbe8882 (pNFS/NFSv4: Try to return invalid layout in     pnfs_layout_process()) removed it while switching the destination to lo->plh_return_segs, which is     drained elsewhere. Commit fb700ef02676 (NFSv4.1: Simplify layout return in pnfs_layout_process())     switched the destination back to free_me without restoring the drain. Restore the pnfs_free_lseg_list()     call. (CVE-2026-89710)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0317-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
    - CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
    - CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
    - CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
    - CVE-2024-56590: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (bsc#1235038).
    - CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
    - CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
    - CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
    - CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
    - CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
    - CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
    - CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
    - CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
    - CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
    - CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
    - CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).

    The following non security issues were fixed:

    - ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (git-fixes).
    - ACPI: PRM: Remove unnecessary strict handler address checks (git-fixes).
    - ACPI: property: Do not pass NULL handles to acpi_attach_data() (git-fixes).
    - ACPI: property: Fix buffer properties extraction for subnodes (git-fixes).
    - KVM: SVM: Fix TSC_AUX virtualization setup (git-fixes).
    - RDMA/cm: Rate limit destroy CM ID timeout error message (git-fixes).
    - RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes).
    - RDMA/hns: Fix the modification of max_send_sge (git-fixes).
    - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes).
    - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes).
    - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
    - RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes).
    - RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes).
    - RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes).
    - RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes).
    - RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes).
    - RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
    - arch/idle: Change arch_cpu_idle() behavior: always exit with IRQs disabled (git-fixes).
    - cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls (git-fixes).
    - cpuidle: Move IRQ state validation (git-fixes).
    - cpuidle: haltpoll: Do not enable interrupts when entering idle (git-fixes).
    - dm: free table mempools if not used in __bind (git-fixes).
    - padata: Honor the caller's alignment in case of chunk_size 0 (bsc#1237563).
    - platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (git-fixes).
    - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (git-fixes).
    - x86/bugs: Use SBPB in write_ibpb() if applicable (git-fixes).
    - x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (git-fixes).
    - x86/tdx: Drop flags from __tdx_hypercall() (git-fixes).
    - x86/tdx: Dynamically disable SEPT violations from causing #VEs (git-fixes).
    - x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (git-fixes).
    - x86/tdx: Extend TDX_MODULE_CALL to support more TDCALL/SEAMCALL leafs (git-fixes).
    - x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed() (git-fixes).
    - x86/tdx: Fix arch_safe_halt() execution for TDX VMs (git-fixes).
    - x86/tdx: Introduce wrappers to read and write TD metadata (git-fixes).
    - x86/tdx: Make TDX_HYPERCALL asm similar to TDX_MODULE_CALL (git-fixes).
    - x86/tdx: Make macros of TDCALLs consistent with the spec (git-fixes).
    - x86/tdx: Pass TDCALL/SEAMCALL input/output registers via a structure (git-fixes).
    - x86/tdx: Reimplement __tdx_hypercall() using TDX_MODULE_CALL asm (git-fixes).
    - x86/tdx: Remove 'struct tdx_hypercall_args' (git-fixes).
    - x86/tdx: Remove TDX_HCALL_ISSUE_STI (git-fixes).
    - x86/tdx: Rename __tdx_module_call() to __tdcall() (git-fixes).
    - x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup() (git-fixes).
    - x86/tdx: Retry partially-completed page conversion hypercalls (git-fixes).
    - x86/tdx: Skip saving output regs when SEAMCALL fails with VMFailInvalid (git-fixes).
    - x86/tdx: Zero out the missing RSI in TDX_HYPERCALL macro (git-fixes).
    - x86/virt/tdx: Make TDX_MODULE_CALL handle SEAMCALL #UD and #GP (git-fixes).
    - x86/virt/tdx: Wire up basic SEAMCALL functions (git-fixes).
    - xfs: fix sparse inode limits on runt AG (bsc#1254392).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - blk-cgroup: dropping parent refcount after pd_free_fn() is done Some cgroup policies will access parent pd     through child pd even after pd_offline_fn() is done. If pd_free_fn() for parent is called before child,     then UAF can be triggered. Hence it's better to guarantee the order of pd_free_fn(). Currently refcount of     parent blkg is dropped in __blkg_release(), which is before pd_free_fn() is called in blkg_free_work_fn()     while blkg_free_work_fn() is called asynchronously. This patch make sure pd_free_fn() called from removing     cgroup is ordered by delaying dropping parent refcount after calling pd_free_fn() for child. BTW,     pd_free_fn() will also be called from blkcg_deactivate_policy() from deleting device, and following     patches will guarantee the order. (CVE-2023-54107)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-138 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    drm: Fix potential null-ptr-deref due to drmm_mode_config_init() (CVE-2022-50556)

    A double-free vulnerability was found in the handling of IORING_OP_SOCKET operation with io_uring on the     Linux kernel. (CVE-2023-1032)

    Due to a type confusion during initializations, the tun and tap sockets in the Linux Kernel have their     socket UID hardcoded to 0, i.e. root. While it will be often correct, as TUN/TAP devices require     CAP_NET_ADMIN, it may not always be the case. The socket UID may be used for network filtering and     routing, thus TUN/TAP sockets may be incorrectly managed, potentially bypassing network filters based on     UID. (CVE-2023-1076)

    kernel: Type confusion in pick_next_rt_entity(), which can result in memory corruption. (CVE-2023-1077)

    A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the     way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate     their privileges on the system. (CVE-2023-1118)

    A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited     to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate     filters in case of a perfect hashes while deleting the underlying structure which can later lead to double     freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to     root.We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28. (CVE-2023-1829)

    When plain IBRS is enabled (not enhanced IBRS), the logic in spectre_v2_user_select_mitigation()     determines that STIBP is not needed. The IBRS bit implicitly protects against cross-thread branch     targetinjection. However, with legacy IBRS, the IBRS bit is cleared on returning to userspace for     performance reasons which leaves userspace threads vulnerable to cross-thread branch target injection     against which STIBP protects. (CVE-2023-1998)

    A use-after-free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw     could allow a local user to cause a denial of service. (CVE-2023-2985)

    An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker     can trigger a race condition that results in a fill_kobj_path out-of-bounds write. (CVE-2023-45863)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/type1: prevent underflow of locked_vm via exec() (CVE-2023-53171)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: uhci: fix memory leak with using debugfs_lookup() (CVE-2023-53197)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: fix percpu counter block leak on error path when creating new netns (CVE-2023-53200)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: domains: fix memory leak with using debugfs_lookup() (CVE-2023-53202)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: location: Free struct acpi_pld_info *pld before return false (CVE-2023-53211)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: efi: Make efi_rt_lock a raw_spinlock (CVE-2023-53216)

    In the Linux kernel, the following vulnerability has been resolved:

    watchdog: Fix kmemleak in watchdog_cdev_register (CVE-2023-53234)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: check IFF_UP earlier in Tx path (CVE-2023-53240)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle (CVE-2023-53250)

    In the Linux kernel, the following vulnerability has been resolved:

    cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (CVE-2023-53254)

    In the Linux kernel, the following vulnerability has been resolved:

    VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF (CVE-2023-53259)

    In the Linux kernel, the following vulnerability has been resolved:

    misc: vmw_balloon: fix memory leak with using debugfs_lookup() (CVE-2023-53279)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Do not update file length for failed writes to inline files (CVE-2023-53295)

    In the Linux kernel, the following vulnerability has been resolved:

    rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails (CVE-2023-53307)

    In the Linux kernel, the following vulnerability has been resolved:

    genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() (CVE-2023-53332)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: fix memory leak with using debugfs_lookup() (CVE-2023-53359)

    In the Linux kernel, the following vulnerability has been resolved:

    block: be a bit more careful in checking for NULL bdev while polling (CVE-2023-53366)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: fix leaked reference count of nfsd4_ssc_umount_item (CVE-2023-53381)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers: base: dd: fix memory leak with using debugfs_lookup() (CVE-2023-53390)

    In the Linux kernel, the following vulnerability has been resolved:

    trace/blktrace: fix memory leak with using debugfs_lookup() (CVE-2023-53408)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers: base: component: fix memory leak with using debugfs_lookup() (CVE-2023-53409)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: EM: fix memory leak with using debugfs_lookup() (CVE-2023-53411)

    In the Linux kernel, the following vulnerability has been resolved:

    objtool: Fix memory leak in create_static_call_sections() (CVE-2023-53423)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix warning and UAF when destroy the MR list (CVE-2023-53427)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Add lwtunnel encap size of all siblings in nexthop calculation (CVE-2023-53477)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu: Fix error unwind in iommu_group_alloc() (CVE-2023-53482)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: xts - Handle EBUSY correctly (CVE-2023-53494)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Do not bother merging very long extents (CVE-2023-53506)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring: fix fget leak when fs don't support nowait buffered read (CVE-2023-53511)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop (CVE-2023-53590)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: fix resource leak in device_add() (CVE-2023-53594)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: clean up potential nfsd_file refcount leaks in COPY codepath (CVE-2023-53606)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip: Fix refcount leak in platform_irqchip_probe (CVE-2023-53610)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: don't access released socket during error recovery (CVE-2023-53643)

    In the Linux kernel, the following vulnerability has been resolved:

    srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL (CVE-2023-53671)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: Fix system suspend without fbdev being initialized (CVE-2023-53678)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Detect system inodes linked into directory hierarchy (CVE-2023-53695)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Handle race between rb_move_tail and rb_check_pages (CVE-2023-53709)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: VMX: Fix crash due to uninitialized current_vmcs (CVE-2023-53756)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache: free background tracker's queued work in btracker_destroy (CVE-2023-53765)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-iocost: fix divide by 0 error in calc_lcoefs() (CVE-2023-53783)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: Improve page fault error reporting (CVE-2023-53789)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Zeroing allocated object from slab in bpf memory allocator (CVE-2023-53790)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: Fix dropping valid root bus resources with .end = zero (CVE-2023-53814)

    In the Linux kernel, the following vulnerability has been resolved:

    loop: loop_set_status_from_info() check before assignment (CVE-2023-53820)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: early: xhci-dbc: Fix a potential out-of-bound memory access (CVE-2023-53840)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Destroy target device if coalesced MMIO unregistration fails (CVE-2023-54024)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: essiv - Handle EBUSY correctly (CVE-2023-54046)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter (CVE-2023-54057)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-cgroup: dropping parent refcount after pd_free_fn() is done (CVE-2023-54107)

    In the Linux kernel, the following vulnerability has been resolved:

    leds: led-core: Fix refcount leak in of_led_get() (CVE-2023-54190)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: fix out-of-bounds access in tty_driver_lookup_tty() (CVE-2023-54198)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ebtables: fix table blob use-after-free (CVE-2023-54243)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix lost destroy smbd connection when MR allocate failed (CVE-2023-54260)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: refuse to create ea block when umounted (CVE-2023-54305)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tls: avoid hanging tasks on the tx_lock (CVE-2023-54306)

    In the Linux kernel, the following vulnerability has been resolved:

    dm flakey: don't corrupt the zero page (CVE-2023-54317)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: fix potential null-ptr-deref in device_add() (CVE-2023-54321)

    kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
381298	AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1794643812)	Nessus	Alma Linux Local Security Checks	Local	high
297191	SUSE SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:0317-1)	Nessus	SuSE Local Security Checks	Local	high
279823	Linux Distros Unpatched Vulnerability : CVE-2023-54107	Nessus	Misc.	Local	high
173340	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-138)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2023-54107

high

Tenable Plugins

high

high

high

high