Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2658-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
    - CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
    - CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
    - CVE-2026-31405: media: dvb-net: fix OOB access in ULE extension header tables (bsc#1261700).
    - CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
    - CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
    - CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
    - CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).
    - CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed     (bsc#1263880).
    - CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).
    - CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).
    - CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).
    - CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).
    - CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).
    - CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265116).
    - CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).
    - CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).
    - CVE-2026-45984: gfs2: Move the inode glock locking to gfs2_file_buffered_write (bsc#1267214).
    - CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
    - CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).
    - CVE-2026-46113: KVM: x86/mmu: Add helper to convert SPTE value to its shadow page (bsc#1266969).
    - CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).
    - CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267640).
    - CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621).
    - CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).
    - CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak     (bsc#1267652).
    - CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).
    - CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1265211 bsc#1267651).

    The following non security issues were fixed:

    - arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).
    - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).
    - KVM: x86: Constrain guest-supported xfeatures only at KVM_GET_XSAVE{2} (bsc#1247954).
    - KVM: x86: Remove 'return void' expression for 'void function' (bsc#1247954).
    - smb: client: correctly handle ErrorContextData as a flexible array (git-fixes).
    - x86/fpu: Allow caller to constrain xfeatures when copying to uabi buffer (bsc#1247954).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2632-1 advisory.

    The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
    - CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
    - CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
    - CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
    - CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).
    - CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed     (bsc#1263880).
    - CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).
    - CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).
    - CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers     (bsc#1264145).
    - CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).
    - CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).
    - CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).
    - CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).
    - CVE-2026-45878: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (bsc#1266767).
    - CVE-2026-45886: bpf: Fix bpf_xdp_store_bytes proto for read-only arg (bsc#1266810).
    - CVE-2026-45932: bpf: Fix tcx/netkit detach permissions when prog fd isn't given (bsc#1266827).
    - CVE-2026-45984: gfs2: Move the inode glock locking to gfs2_file_buffered_write (bsc#1267214).
    - CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).
    - CVE-2026-46090: ALSA: aloop: Use guard() for spin locks (bsc#1267531).
    - CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267640).
    - CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621).
    - CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).
    - CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak     (bsc#1267652).
    - CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381).
    - CVE-2026-46209: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()     (bsc#1267663).
    - CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).
    - CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1265211 bsc#1267651).

    The following non security issues were fixed:

    - bnxt_en: Fix NULL pointer dereference (bsc#1268307).
    - Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs (git-fixes).
    - ethtool: provide customized dim profile management (bsc#1261256).
    - hv: utils: handle and propagate errors in kvp_register (git-fixes).
    - hyperv: Clean up and fix the guest ID comment in hvgdk.h (git-fixes).
    - linux/dim: move useful macros to .h file (bsc#1261256).
    - net: ethtool: add ethtool COALESCE_RX_CQE_FRAMES/NSECS (bsc#1261256).
    - net: mana: Add ethtool counters for RX CQEs in coalesced type (bsc#1261256).
    - net: mana: Add support for RX CQE Coalescing (bsc#1261256).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2638-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
    - CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
    - CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
    - CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
    - CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
    - CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
    - CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).
    - CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed     (bsc#1263880).
    - CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).
    - CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).
    - CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).
    - CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).
    - CVE-2026-45984: gfs2: Move the inode glock locking to gfs2_file_buffered_write (bsc#1267214).
    - CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267361).
    - CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).
    - CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267640).
    - CVE-2026-46123: Bluetooth: virtio_bt: clamp rx length before skb_put (bsc#1267621).
    - CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).
    - CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak     (bsc#1267652).
    - CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381).
    - CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267697).

    The following non security issues were fixed:

    - smb: client: correctly handle ErrorContextData as a flexible array (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2450-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

    The following security issues were fixed:

    - CVE-2025-10263: arm64: Add workaround for Cortex-A76 erratum 1286807 (bsc#1266290).
    - CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
    - CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
    - CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).
    - CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
    - CVE-2026-23279: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() (bsc#1260468).
    - CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
    - CVE-2026-23367: wifi: radiotap: reject radiotap with unknown bits (bsc#1260731).
    - CVE-2026-23396: wifi: mac80211: fix NULL deref in mesh_matches_local() (bsc#1260729).
    - CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
    - CVE-2026-23448: net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check (bsc#1261750).
    - CVE-2026-31405: media: dvb-net: fix OOB access in ULE extension header tables (bsc#1261700).
    - CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099).
    - CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061).
    - CVE-2026-31447: ext4: reject mount if bigalloc with s_first_data_block != 0 (bsc#1262614).
    - CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
    - CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
    - CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false       (bsc#1267816).
    - CVE-2026-31498: Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop (bsc#1262751).
    - CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
    - CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752).
    - CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
    - CVE-2026-31532: can: af_can: export can_sock_destruct() (bsc#1262757).
    - CVE-2026-31540: drm/i915/gt: Check set_default_submission() before deferencing (bsc#1263011).
    - CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
    - CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
    - CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
    - CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
    - CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
    - CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).
    - CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140).
    - CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
    - CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
    - CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
    - CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).
    - CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).
    - CVE-2026-31778: ALSA: caiaq: fix stack out-of-bounds read in init_card (bsc#1263923).
    - CVE-2026-43020: Bluetooth: MGMT: validate LTK enc_size on load (bsc#1264006).
    - CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
    - CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
    - CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
    - CVE-2026-43037: ip6_tunnel: clear skb2->cb in ip4ip6_err() (bsc#1263995).
    - CVE-2026-43038: ipv6: icmp: clear skb2->cb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).
    - CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to     prevent an info-       leak (bsc#1264091).
    - CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).
    - CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).
    - CVE-2026-43140: HID: magicmouse: Do not crash on missing msc->input (bsc#1264630).
    - CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).
    - CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).
    - CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).
    - CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).
    - CVE-2026-43234: team: avoid NETDEV_CHANGEMTU event when unregistering slave (bsc#1264409).
    - CVE-2026-43338: btrfs: reserve enough transaction items for qgroup ioctls (bsc#1264716).
    - CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).
    - CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow (bsc#1264719).
    - CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes (bsc#1264722).
    - CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (bsc#1265020).
    - CVE-2026-43413: scsi: hisi_sas: Fix NULL pointer exception during user_scan() (bsc#1264671).
    - CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free (bsc#1264669).
    - CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).
    - CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).
    - CVE-2026-45835: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (bsc#1266411).
    - CVE-2026-45841: netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (bsc#1266390).
    - CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
    - CVE-2026-45843: slip: bound decode() reads against the compressed packet length (bsc#1266395).
    - CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).
    - CVE-2026-45870: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths (bsc#1266704).
    - CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).
    - CVE-2026-45983: nfsd: never defer requests during idmap lookup (bsc#1266697).
    - CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
    - CVE-2026-46024: libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (bsc#1267218).
    - CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).
    - CVE-2026-46090: ALSA: aloop: Fix peer runtime UAF during format-change stop (bsc#1267531).
    - CVE-2026-46113: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (bsc#1266969).
    - CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).
    - CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267387).
    - CVE-2026-46157: ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (bsc#1267726).
    - CVE-2026-46159: btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak     (bsc#1267652).
    - CVE-2026-46160: btrfs: fix missing last_unlink_trans update when removing a directory (bsc#1267624).
    - CVE-2026-46169: hfsplus: fix uninit-value by validating catalog record size (bsc#1267713).
    - CVE-2026-46181: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (bsc#1266826).
    - CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).
    - CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat()     (bsc#1267685).
    - CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS (bsc#1267651).

    The following non security issues were fixed:

    - arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).
    - arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).
    - bcache: fix uninitialized closure object (git-fixes).
    - check-for-config-changes: Exclude CC_MS_EXTENSIONS.
    - check-for-config-changes: Exclude HAVE_CFI_ICALL_NORMALIZE_INTEGERS{,_RUSTC}.
    - kvm/svm: PKU not currently supported (bsc#1263887).
    - KVM: x86: Handle PKU CPUID adjustment in VMX code (bsc#1263887).
    - mkspec: Add signature to source list only when it exists.
    - net/sched: cls_fw: fix NULL dereference of 'old' filters before change() (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-24b84f97af advisory.

    x86 HVM I/O port list traversal [XSA-491, CVE-2026-42487]     domctl lock open to abuse [XSA-492, CVE-2026-42489, CVE-2026-42490]     Arm: Completion of memory accesses not guaranteed by completion of a TLBI     [XSA-493, CVE-2025-10263]     x86: mismatched mapcache metadata [XSA-494, CVE-2026-42488]

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-75fcc75b5f advisory.

    The 7.0.12-101/201 updates contain fixes for CVE-2025-10263.  This CVE, while important, only impacts     specific aarch64 CPUs.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8b619eef6f advisory.

    The 7.0.12-101/201 updates contain fixes for CVE-2025-10263.  This CVE, while important, only impacts     specific aarch64 CPUs.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 438b0278-6474-11f1-958d-bc241121aa0a advisory.

    Some Arm CPUs have errata where the ordering of stores and the               TLBI+DSB sequence may be incorrect.  If one CPU stores to a virtual               address while another CPU invalidates the translation for that               address, the second CPU's TLBI+DSB may complete before the first               CPU's store has been globally observed.
    This erratum may allow software to write to a previously writable               location after the page table is modified to forbid writes to that               location.  Consequently this may allow software to write to memory               owned by a higher exception level, possibly allowing software to               escalate privilege to that higher exception level.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1,
    Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C,
    Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.
    (CVE-2025-10263)

  - HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are
    managed by the device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed at
    any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing
    with updates, which was missing so far. (CVE-2026-42487)

  - Some shadow paging errors paths will switch the page-tables without updating the currently running vCPU
    reference. This causes a mismatch between the loaded page-tables and the mapcache metadata which can lead
    to corruption of the mapcache. (CVE-2026-42488)

  - [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities
    correspond to which CVE.] To create and manage guests, domctl operations are used by the control domain, a
    possible Xenstore domain, or by a domain controlling a particular guest. Some of these operations may not
    be executed in parallel, so a system-wide lock is used. The way that lock is acquired is, however, not
    providing any fairness. This is CVE-2026-42489. Furthermore, with XSM/Flask in use, the lock acquire will,
    for some operations, occur ahead of any permission checking. This is CVE-2026-42490. (CVE-2026-42489,
    CVE-2026-42490)

The remote Windows host is missing security update 5094127. It is, therefore, affected by multiple vulnerabilities

  - Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a     network. (CVE-2026-42909, CVE-2026-42985, CVE-2026-42992, CVE-2026-42993, CVE-2026-44799, CVE-2026-44801,     CVE-2026-47289, CVE-2026-47653, CVE-2026-48563)

  - Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1,     Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C,     Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.
    (CVE-2025-10263)

  - Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges     locally. (CVE-2026-41108)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5093998. It is, therefore, affected by multiple vulnerabilities

  - Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a     network. (CVE-2026-42909, CVE-2026-42913, CVE-2026-42985, CVE-2026-42992, CVE-2026-42993, CVE-2026-44799,     CVE-2026-44801, CVE-2026-47289, CVE-2026-47653, CVE-2026-48563)

  - Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1,     Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C,     Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.
    (CVE-2025-10263)

  - Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges     locally. (CVE-2026-41108)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5094126. It is, therefore, affected by multiple vulnerabilities

  - Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a     network. (CVE-2026-42909, CVE-2026-42913, CVE-2026-42985, CVE-2026-42992, CVE-2026-42993, CVE-2026-44799,     CVE-2026-44801, CVE-2026-47289, CVE-2026-47653, CVE-2026-48563)

  - Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1,     Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C,     Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.
    (CVE-2025-10263)

  - Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges     locally. (CVE-2026-41108)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5095051. It is, therefore, affected by multiple vulnerabilities

  - Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a     network. (CVE-2026-42909, CVE-2026-42913, CVE-2026-42985, CVE-2026-42992, CVE-2026-42993, CVE-2026-44799,     CVE-2026-44801, CVE-2026-47289, CVE-2026-47653, CVE-2026-48563)

  - Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1,     Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C,     Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.
    (CVE-2025-10263)

  - Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges     locally. (CVE-2026-41108)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-50304 advisory.

    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39017589]     {CVE-2025-10263}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-50305 advisory.

    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39017590]     {CVE-2025-10263}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)  [Orabug:
    39368827]  {CVE-2026-46300}
    - ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds)  [Orabug: 39384274]  {CVE-2026-46333}
    - Revert 'mm/hugetlb: add option to allows disabling CVE-2025-38085 mitigation' (Samasth Norway Ananda)     [Orabug: 38474901]
    - x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39327141]  {CVE-2025-54518}
    - xfrm: esp: ipv4: fix up flags setting (Greg Kroah-Hartman)  [Orabug: 39342679]  {CVE-2026-43284}
    - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39342679]     {CVE-2026-43284}
    - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton)  [Orabug: 39167616]  {CVE-2026-31402}
    - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (Victor Nogueira)     [Orabug: 39103230]  {CVE-2026-23270}
    - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [Orabug: 39250686,39331104]     {CVE-2026-43077}
    - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug:
    39250686,39331109] {CVE-2026-43078}
    - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [Orabug:
    39250686,39300910] {CVE-2026-43033}
    - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [Orabug: 39250686,39283867,39291961]     {CVE-2026-31431}
    - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250686]     {CVE-2026-31431}
    - x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov) [Orabug: 39241228,39273722] {CVE-2026-31628}
    - net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847720]     {CVE-2025-68775}
    - ipv6: use RCU in ip6_xmit() (Eric Dumazet) [Orabug: 38649062] {CVE-2025-40135}
    - scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930868]     {CVE-2026-23059}
    - bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887702]     {CVE-2026-22994}
    - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887682]     {CVE-2026-22989}
    - net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970398] {CVE-2026-23173}
    - net/handshake: restore destructor on submit failure (Caoping) [Orabug: 38887601] {CVE-2025-71148}
    - scsi: qla2xxx: Fix improper freeing of purex item (Zilin Guan) [Orabug: 38798929] {CVE-2025-68741}
    - bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847684] {CVE-2025-68770}
    - perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847849]     {CVE-2025-68798}
    - scsi: smartpqi: Fix device resources accessed after device removal (Mike Mcgowen) [Orabug: 38798848]     {CVE-2025-68371}
    - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (Omar Sandoval) [Orabug: 38773579]     {CVE-2025-68259}
    - x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae) [Orabug: 38773165] {CVE-2025-68171}
    - virtio-net: fix received length check in big packets (Bui Quang Minh) [Orabug: 38737152]     {CVE-2025-40292}
    - ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38641284]     {CVE-2025-38113}
    - EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo) [Orabug: 38649173]     {CVE-2025-40157}
    - sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu) [Orabug: 38649042]     {CVE-2025-40129}
    - cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost() (Jinjie Ruan) [Orabug: 38641275]     {CVE-2024-53230}
    - cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw() (Jinjie Ruan) [Orabug: 38641272]     {CVE-2024-53231}
    - vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592117]     {CVE-2025-40056}
    - crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401717]     {CVE-2025-39721}
    - vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592085] {CVE-2025-40051}
    - virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324330] {CVE-2025-38551}
    - gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401492] {CVE-2025-38735}
    - KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson)     [Orabug: 38254140] {CVE-2025-38455}
    - net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253871]     {CVE-2025-38385}
    - net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094809]     {CVE-2025-38020}
    - dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094794]     {CVE-2025-38015}
    - net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152903] {CVE-2025-38109}
    - bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175054] {CVE-2025-38246}
    - eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski) [Orabug: 37937451]     {CVE-2025-37873}
    - net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin) [Orabug: 37938078]     {CVE-2025-37888}
    - nfsd: fix possible badness in FREE_STATEID (Olga Kornievskaia) [Orabug: 37989102] {CVE-2024-50043}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-50306 advisory.

    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39017592]     {CVE-2025-10263}
    - ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds) [Orabug: 39384275,39391459]     {CVE-2026-46333}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug:
    39368828,39441326] {CVE-2026-43503,CVE-2026-46300}
    - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39368828]     {CVE-2026-46300}
    - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton) [Orabug: 39167617,39368718]     {CVE-2026-31402}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug:
    38985173,39368732] {CVE-2026-23216}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug:
    38970455,39368774] {CVE-2026-23193}
    - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen) [Orabug: 39334580,39367147]     {CVE-2026-43284}
    - x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia) [Orabug: 39218897] {CVE-2025-54518}
    - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [Orabug: 39250687,39331106]     {CVE-2026-43077}
    - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug:
    39250687,39331111] {CVE-2026-43078}
    - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [Orabug:
    39250687,39300911] {CVE-2026-43033}
    - crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le) [Orabug: 39250687,39452217]     {CVE-2026-46028}
    - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [Orabug: 39250687,39283868,39292250]     {CVE-2026-31431}
    - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250687]     {CVE-2026-31431}
    - x86/CPU: Fix FPDSS on Zen1 (Siddh Raman Pant) [Orabug: 39241225,39273723] {CVE-2026-31628}
    - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers)     [Orabug: 38852342] {CVE-2025-71120}
    - net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930950]     {CVE-2026-23074}
    - macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887731] {CVE-2026-23001}
    - macvlan: Use 'hash' iterators to simplify code (Christophe Jaillet) [Orabug: 38887731] {CVE-2026-23001}
    - macvlan: Add nodst option to macvlan type source (Jethro Beekman) [Orabug: 38887731] {CVE-2026-23001}
    - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug:
    38970510,39188399] {CVE-2026-23209,CVE-2026-23273}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1,     Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C,     Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.
    (CVE-2025-10263)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
323249	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2658-1)	Nessus	SuSE Local Security Checks	high
323031	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2632-1)	Nessus	SuSE Local Security Checks	high
323029	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2638-1)	Nessus	SuSE Local Security Checks	high
321690	SUSE SLES12 Security Update : kernel (SUSE-SU-2026:2450-1)	Nessus	SuSE Local Security Checks	medium
321439	Fedora 44 : xen (2026-24b84f97af)	Nessus	Fedora Local Security Checks	critical
320773	Fedora 43 : kernel (2026-75fcc75b5f)	Nessus	Fedora Local Security Checks	critical
320771	Fedora 44 : kernel (2026-8b619eef6f)	Nessus	Fedora Local Security Checks	critical
320475	FreeBSD : FreeBSD -- Arm CPU errata may bypass page table permission changes (438b0278-6474-11f1-958d-bc241121aa0a)	Nessus	FreeBSD Local Security Checks	critical
442839	Alpine: multiple xen packages: security update to 4.20.3-r4	Tenable Cloud Security	Alpine Linux Local Security Checks	high
442839	Alpine: multiple xen packages: security update to 4.20.3-r4	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
320195	KB5094127: Windows 10 version 21H2 / Windows 10 Version 22H2 Security Update (June 2026)	Nessus	Windows : Microsoft Bulletins	high
320193	KB5093998: Windows 11 version 23H2 Security Update (June 2026)	Nessus	Windows : Microsoft Bulletins	high
320188	KB5094126: Windows 11 Version 24H2 / Windows 11 Version 25H2 Security Update (June 2026)	Nessus	Windows : Microsoft Bulletins	high
320182	KB5095051: Windows 11 Version 26H1 Security Update (June 2026)	Nessus	Windows : Microsoft Bulletins	high
320172	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50304)	Nessus	Oracle Linux Local Security Checks	critical
320171	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50305)	Nessus	Oracle Linux Local Security Checks	critical
320170	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2026-50306)	Nessus	Oracle Linux Local Security Checks	critical
320169	Linux Distros Unpatched Vulnerability : CVE-2025-10263	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-10263

high

Tenable Plugins

high

high

high

medium

critical

critical

critical

critical

high

high

high

high

high

high

critical

critical

critical

critical