In the Linux kernel, the following vulnerability has been resolved: kernel: be more careful about dup_mmap() failures and uprobe registering If a memory allocation fails during dup_mmap(), the maple tree can be left in an unsafe state for other iterators besides the exit path. All the locks are dropped before the exit_mmap() call (in mm/mmap.c), but the incomplete mm_struct can be reached through (at least) the rmap finding the vmas which have a pointer back to the mm_struct. Up to this point, there have been no issues with being able to find an mm_struct that was only partially initialised. Syzbot was able to make the incomplete mm_struct fail with recent forking changes, so it has been proven unsafe to use the mm_struct that hasn't been initialised, as referenced in the link below. Although 8ac662f5da19f ("fork: avoid inappropriate uprobe access to invalid mm") fixed the uprobe access, it does not completely remove the race. This patch sets the MMF_OOM_SKIP to avoid the iteration of the vmas on the oom side (even though this is extremely unlikely to be selected as an oom victim in the race window), and sets MMF_UNSTABLE to avoid other potential users from using a partially initialised mm_struct. When registering vmas for uprobe, skip the vmas in an mm that is marked unstable. Modifying a vma in an unstable mm may cause issues if the mm isn't fully initialised.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50372 advisory.

    - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)   {CVE-2026-46331}
    - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Christian Brauner)  [Orabug: 39668743]     {CVE-2026-46242}
    - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen)  [Orabug: 39656679]     {CVE-2026-52943}
    - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland)  [Orabug: 39548792]     {CVE-2025-10263}
    - openvswitch: vport: fix self-deadlock on release of tunnel ports (Ilya Maximets) {CVE-2026-46165}
    - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Ankit Soni)     {CVE-2026-43220}
    - usb: ulpi: fix memory leak on ulpi_register() error paths (Felix Gu) {CVE-2026-46109}
    - smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada)  [Orabug: 39463671]     {CVE-2026-46243}
    - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug:
    39368826,39441323] {CVE-2026-43503,CVE-2026-46300}
    - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39368826]     {CVE-2026-46300}
    - netfilter: reject zero shift in nft_bitwise (Kai Ma) [Orabug: 39452464] {CVE-2026-46101}
    - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Andrea Mayer) [Orabug: 39452457]     {CVE-2026-46099}
    - ALSA: caiaq: fix usb_dev refcount leak on probe failure (Deepanshu Kartikey) [Orabug: 39452739]     {CVE-2026-46048}
    - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Greg Kroah-Hartman) [Orabug: 39426003]     {CVE-2026-43501}
    - ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path (Takashi Iwai) [Orabug: 39452746]     {CVE-2026-45992}
    - net: bonding: fix use-after-free in bond_xmit_broadcast() (Xiang Mei) [Orabug: 39205989]     {CVE-2026-31419}
    - crypto: authencesn - reject short ahash digests during instance creation (Yucheng Lu) [Orabug: 39452231]     {CVE-2026-46033}
    - spi: fix resource leaks on device setup failure (Johan Hovold) [Orabug: 39452400] {CVE-2026-46083}
    - net: qrtr: ns: Limit the total number of nodes (Manivannan Sadhasivam) [Orabug: 39452123]     {CVE-2026-46003}
    - net: bridge: use a stable FDB dst snapshot in RCU readers (Zhengchuan Liang) [Orabug: 39452411]     {CVE-2026-46086}
    - net: qrtr: ns: Limit the maximum number of lookups (Manivannan Sadhasivam) [Orabug: 39452207]     {CVE-2026-46026}
    - net: qrtr: ns: Limit the maximum server registration per node (Manivannan Sadhasivam) [Orabug: 39410851]     {CVE-2026-43491}
    - RDMA/mana_ib: Disable RX steering on RSS QP destroy (Long Li) [Orabug: 39452406] {CVE-2026-46084}
    - media: rc: igorplugusb: heed coherency rules (Oliver Neukum) [Orabug: 39452432] {CVE-2026-46091}
    - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (Daniel Hodges) [Orabug: 39452343]     {CVE-2026-46069}
    - thermal: core: Fix thermal zone governor cleanup issues (Rafael J. Wysocki) [Orabug: 39452186]     {CVE-2026-46021}
    - smb: client: validate the whole DACL before rewriting it in cifsacl (Michael Bommarito) [Orabug:
    39300611] {CVE-2026-31709}
    - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (Yang Xiuwei) [Orabug: 39452100]     {CVE-2026-45997}
    - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39425998]     {CVE-2026-43499}
    - ceph: only d_add() negative dentries when they are unhashed (Max Kellermann) [Orabug: 39452291]     {CVE-2026-46052}
    - dm mirror: fix integer overflow in create_dirty_log() (Junrui Luo) [Orabug: 39452196] {CVE-2026-46023}
    - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (Shuvam Pandey) [Orabug: 39452304]     {CVE-2026-46056}
    - tcp: call sk_data_ready() after listener migration (Zhenzhong Wu) [Orabug: 39452159] {CVE-2026-46015}
    - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails (Chia-Ming Chang) [Orabug:
    39452250] {CVE-2026-46040}
    - md/raid5: validate payload size before accessing journal metadata (Junrui Luo) [Orabug: 39452349]     {CVE-2026-46070}
    - md/raid5: fix soft lockup in retry_aligned_read() (Chia-Ming Chang) [Orabug: 39452287] {CVE-2026-46051}
    - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (Sohei Koyama) [Orabug: 39452269]     {CVE-2026-46046}
    - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (Deepanshu Kartikey) [Orabug:
    39452442] {CVE-2026-46094}
    - io_uring/poll: fix multishot recv missing EOF on wakeup race (Jens Axboe) {CVE-2026-23473}
    - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Kevin Cheng) [Orabug: 39452372]     {CVE-2026-46076}
    - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (Kevin Cheng) [Orabug: 39452394] {CVE-2026-46082}
    - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (Yosry Ahmed) [Orabug: 39452061]     {CVE-2026-45987}
    - xfs: fix a resource leak in xfs_alloc_buftarg() (Haoxiang Li) [Orabug: 39452131] {CVE-2026-46005}
    - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (Raphael Zimmer) [Orabug:
    39452201] {CVE-2026-46024}
    - ipv4: icmp: validate reply type before using icmp_pointers (Ruide Cao) [Orabug: 39452243]     {CVE-2026-46037}
    - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Hkbinbin) [Orabug: 39452259]     {CVE-2026-46043}
    - net: qrtr: ns: Free the node during ctrl_cmd_bye() (Manivannan Sadhasivam) [Orabug: 39452246]     {CVE-2026-46038}
    - rxrpc: Fix rxkad crypto unalignment handling (David Howells) [Orabug: 39452728] {CVE-2026-46085}
    - ALSA: caiaq: Handle probe errors properly (Takashi Iwai) [Orabug: 39452126] {CVE-2026-46004}
    - rbd: fix null-ptr-deref when device_add_disk() fails (Dawei Feng) [Orabug: 39452385] {CVE-2026-46079}
    - md/raid10: fix deadlock with check operation and nowait requests (Josh Hunt) [Orabug: 39452284]     {CVE-2026-46050}
    - jbd2: fix deadlock in jbd2_journal_cancel_revoke() (Zhang Yi) [Orabug: 39452318] {CVE-2026-46061}
    - erofs: fix the out-of-bounds nameoff handling for trailing dirents (Gao Xiang) [Orabug: 39452380]     {CVE-2026-46078}
    - ALSA: ctxfi: Add fallback to default RSR for S/PDIF (Harin Lee) [Orabug: 39452280] {CVE-2026-46049}
    - ext2: reject inodes with zero i_nlink and valid mode in ext2_iget() (Vasiliy Kovalev) [Orabug: 39452119]     {CVE-2026-46002}
    - net: qrtr: ns: Fix use-after-free in driver remove() (Manivannan Sadhasivam) [Orabug: 39452274]     {CVE-2026-46047}
    - net: strparser: fix skb_head leak in strp_abort_strp() (Luxiao Xu) [Orabug: 39452468] {CVE-2026-46102}
    - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (Ziqing Chen)     [Orabug: 39452416] {CVE-2026-46088}
    - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Herbert Xu) [Orabug: 39410863] {CVE-2026-43493}
    - wifi: rtw88: check for PCI upstream bridge existence (Fedor Pchelkin) [Orabug: 39452437]     {CVE-2026-46092}
    - zram: do not forget to endio for partial discard requests (Sergey Senozhatsky) [Orabug: 39452420]     {CVE-2026-46089}
    - ocfs2: split transactions in dio completion to avoid credit exhaustion (Heming Zhao) [Orabug: 39452388]     {CVE-2026-46080}
    - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (Jesse Zhang) [Orabug: 39167551]     {CVE-2026-23468}
    - padata: Fix pd UAF once and for all (Herbert Xu) [Orabug: 38335055] {CVE-2025-38584}
    - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (Greg Kroah-Hartman) [Orabug: 39452133]     {CVE-2026-46006}
    - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES (Cassio Gabriel) [Orabug: 39452170]     {CVE-2026-46018}
    - Buffer overflow in drivers/xen/sys-hypervisor.c (Juergen Gross) [Orabug: 39305898] {CVE-2026-31786}
    - xen/privcmd: fix double free via VMA splitting (Juergen Gross) [Orabug: 39305908] {CVE-2026-31787}
    - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing (Anderson Nascimento) [Orabug:
    39300563] {CVE-2026-31696}
    - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31697}
    - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31698}
    - crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (Sean Christopherson)     {CVE-2026-31699}
    - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (Bingquan Chen) {CVE-2026-31700}
    - ALSA: caiaq: take a reference on the USB device in create_card() (Berk Cem Goksel) [Orabug: 39300586]     {CVE-2026-31701}
    - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (Michael Bommarito) [Orabug:
    39300607] {CVE-2026-31708}
    - smb: client: require a full NFS mode SID before reading mode bits (Michael Bommarito) [Orabug: 39343707]     {CVE-2026-43350}
    - fuse: reject oversized dirents in page cache (Samuel Page) [Orabug: 39300556] {CVE-2026-31694}
    - mm/pagewalk: fix race between concurrent split and refault (Max Boone) [Orabug: 39250782]     {CVE-2026-31456}
    - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (Felix Fietkau) [Orabug: 39167472]     {CVE-2026-23444}
    - mm/userfaultfd: fix hugetlb fault mutex hash calculation (Jianhui Zhou) [Orabug: 39273453]     {CVE-2026-31575}
    - ipv6: add NULL checks for idev in SRv6 paths (Heminhong) [Orabug: 39167467] {CVE-2026-23442}
    - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline (Joseph Qi) [Orabug: 39331090] {CVE-2026-43075}
    - ocfs2: validate inline data i_size during inode read (Deepanshu Kartikey) [Orabug: 39331097]     {CVE-2026-43076}
    - media: as102: fix to not free memory after the device is registered in as102_usb_probe() (Jeongjun Park)     [Orabug: 39273467] {CVE-2026-31578}
    - bcache: fix cached_dev.sb_bio use-after-free and crash (Mingzhe Zou) [Orabug: 39273481] {CVE-2026-31580}
    - ALSA: 6fire: fix use-after-free on disconnect (Berk Cem Goksel) [Orabug: 39273486] {CVE-2026-31581}
    - media: em28xx: fix use-after-free in em28xx_v4l2_open() (Abhishek Kumar) [Orabug: 39273493]     {CVE-2026-31583}
    - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (Breno Leitao) [Orabug: 39273507]     {CVE-2026-31586}
    - KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug:
    39273521] {CVE-2026-31588}
    - x86-64: rename misleadingly named '__copy_user_nocache()' function (Linus Torvalds) [Orabug: 39323162]     {CVE-2026-43073}
    - kernel: be more careful about dup_mmap() failures and uprobe registering (Liam R. Howlett)     {CVE-2025-21709}
    - gpiolib: fix race condition for gdev->srcu (Pawel Narewski) [Orabug: 38887677] {CVE-2026-22986}
    - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (Sean Christopherson) [Orabug:
    39273529] {CVE-2026-31590}
    - KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (Sean Christopherson)     [Orabug: 39273553] {CVE-2026-31593}
    - ocfs2: handle invalid dinode in ocfs2_group_extend (Zhengyuan Huang) [Orabug: 39273569] {CVE-2026-31596}
    - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY (Tejas Bharambe) [Orabug: 39273578]     {CVE-2026-31597}
    - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273586]     {CVE-2026-31598}
    - dcache: Limit the minimal number of bucket to two (Zhihao Cheng) [Orabug: 39323133] {CVE-2026-43071}
    - ALSA: ctxfi: Limit PTP to a single page (Harin Lee) [Orabug: 39273608] {CVE-2026-31602}
    - wifi: rtw88: fix device leak on probe failure (Johan Hovold) [Orabug: 39273620] {CVE-2026-31604}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6238 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6238-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     April 30, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2024-14027 CVE-2025-21709 CVE-2025-22116 CVE-2025-22117                      CVE-2025-38426 CVE-2025-38627 CVE-2025-39764 CVE-2025-40005                      CVE-2025-40135 CVE-2025-40147 CVE-2025-40150 CVE-2025-40219                      CVE-2025-68175 CVE-2025-68239 CVE-2025-68334 CVE-2025-68736                      CVE-2025-71152 CVE-2025-71161 CVE-2025-71221 CVE-2025-71239                      CVE-2025-71265 CVE-2025-71266 CVE-2025-71267 CVE-2025-71269                      CVE-2026-22981 CVE-2026-22985 CVE-2026-22986 CVE-2026-22993                      CVE-2026-23004 CVE-2026-23066 CVE-2026-23070 CVE-2026-23104                      CVE-2026-23138 CVE-2026-23157 CVE-2026-23207 CVE-2026-23210                      CVE-2026-23226 CVE-2026-23227 CVE-2026-23231 CVE-2026-23239                      CVE-2026-23240 CVE-2026-23242 CVE-2026-23243 CVE-2026-23244                      CVE-2026-23245 CVE-2026-23246 CVE-2026-23249 CVE-2026-23250                      CVE-2026-23251 CVE-2026-23252 CVE-2026-23253 CVE-2026-23255                      CVE-2026-23270 CVE-2026-23271 CVE-2026-23273 CVE-2026-23274                      CVE-2026-23276 CVE-2026-23277 CVE-2026-23278 CVE-2026-23279                      CVE-2026-23281 CVE-2026-23284 CVE-2026-23285 CVE-2026-23286                      CVE-2026-23287 CVE-2026-23289 CVE-2026-23290 CVE-2026-23291                      CVE-2026-23292 CVE-2026-23293 CVE-2026-23296 CVE-2026-23297                      CVE-2026-23298 CVE-2026-23300 CVE-2026-23302 CVE-2026-23303                      CVE-2026-23304 CVE-2026-23306 CVE-2026-23307 CVE-2026-23308                      CVE-2026-23310 CVE-2026-23312 CVE-2026-23313 CVE-2026-23315                      CVE-2026-23316 CVE-2026-23317 CVE-2026-23318 CVE-2026-23319                      CVE-2026-23321 CVE-2026-23324 CVE-2026-23325 CVE-2026-23330                      CVE-2026-23334 CVE-2026-23335 CVE-2026-23336 CVE-2026-23339                      CVE-2026-23340 CVE-2026-23343 CVE-2026-23347 CVE-2026-23351                      CVE-2026-23352 CVE-2026-23354 CVE-2026-23356 CVE-2026-23357                      CVE-2026-23359 CVE-2026-23360 CVE-2026-23361 CVE-2026-23362                      CVE-2026-23363 CVE-2026-23364 CVE-2026-23365 CVE-2026-23367                      CVE-2026-23368 CVE-2026-23369 CVE-2026-23370 CVE-2026-23372                      CVE-2026-23373 CVE-2026-23374 CVE-2026-23375 CVE-2026-23378                      CVE-2026-23379 CVE-2026-23380 CVE-2026-23381 CVE-2026-23382                      CVE-2026-23383 CVE-2026-23386 CVE-2026-23387 CVE-2026-23388                      CVE-2026-23389 CVE-2026-23391 CVE-2026-23392 CVE-2026-23393                      CVE-2026-23395 CVE-2026-23396 CVE-2026-23397 CVE-2026-23398                      CVE-2026-23399 CVE-2026-23401 CVE-2026-23412 CVE-2026-23413                      CVE-2026-23414 CVE-2026-23417 CVE-2026-23419 CVE-2026-23420                      CVE-2026-23422 CVE-2026-23426 CVE-2026-23427 CVE-2026-23428                      CVE-2026-23434 CVE-2026-23438 CVE-2026-23439 CVE-2026-23440                      CVE-2026-23441 CVE-2026-23442 CVE-2026-23444 CVE-2026-23445                      CVE-2026-23446 CVE-2026-23447 CVE-2026-23448 CVE-2026-23449                      CVE-2026-23450 CVE-2026-23452 CVE-2026-23454 CVE-2026-23455                      CVE-2026-23456 CVE-2026-23457 CVE-2026-23458 CVE-2026-23460                      CVE-2026-23461 CVE-2026-23462 CVE-2026-23463 CVE-2026-23464                      CVE-2026-23465 CVE-2026-23466 CVE-2026-23470 CVE-2026-23474                      CVE-2026-23475 CVE-2026-31389 CVE-2026-31391 CVE-2026-31392                      CVE-2026-31393 CVE-2026-31394 CVE-2026-31396 CVE-2026-31399                      CVE-2026-31400 CVE-2026-31401 CVE-2026-31402 CVE-2026-31403                      CVE-2026-31405 CVE-2026-31406 CVE-2026-31407 CVE-2026-31408                      CVE-2026-31409 CVE-2026-31410 CVE-2026-31411 CVE-2026-31412                      CVE-2026-31414 CVE-2026-31415 CVE-2026-31416 CVE-2026-31417                      CVE-2026-31418 CVE-2026-31421 CVE-2026-31422 CVE-2026-31423                      CVE-2026-31424 CVE-2026-31425 CVE-2026-31426 CVE-2026-31427                      CVE-2026-31428 CVE-2026-31429 CVE-2026-31430 CVE-2026-31431                      CVE-2026-31432 CVE-2026-31433 CVE-2026-31434 CVE-2026-31436                      CVE-2026-31438 CVE-2026-31439 CVE-2026-31440 CVE-2026-31441                      CVE-2026-31446 CVE-2026-31447 CVE-2026-31448 CVE-2026-31449                      CVE-2026-31450 CVE-2026-31451 CVE-2026-31452 CVE-2026-31453                      CVE-2026-31454 CVE-2026-31455 CVE-2026-31458 CVE-2026-31462                      CVE-2026-31464 CVE-2026-31466 CVE-2026-31467 CVE-2026-31469                      CVE-2026-31470 CVE-2026-31473 CVE-2026-31474 CVE-2026-31476                      CVE-2026-31477 CVE-2026-31478 CVE-2026-31479 CVE-2026-31480                      CVE-2026-31482 CVE-2026-31483 CVE-2026-31485 CVE-2026-31487                      CVE-2026-31488 CVE-2026-31489 CVE-2026-31492 CVE-2026-31494                      CVE-2026-31495 CVE-2026-31496 CVE-2026-31497 CVE-2026-31498                      CVE-2026-31500 CVE-2026-31502 CVE-2026-31503 CVE-2026-31504                      CVE-2026-31505 CVE-2026-31506 CVE-2026-31507 CVE-2026-31508                      CVE-2026-31509 CVE-2026-31510 CVE-2026-31511 CVE-2026-31512                      CVE-2026-31515 CVE-2026-31516 CVE-2026-31518 CVE-2026-31519                      CVE-2026-31520 CVE-2026-31521 CVE-2026-31522 CVE-2026-31523                      CVE-2026-31524 CVE-2026-31525 CVE-2026-31527 CVE-2026-31528                      CVE-2026-31530 CVE-2026-31531 CVE-2026-31532 CVE-2026-31533                      CVE-2026-31540 CVE-2026-31542 CVE-2026-31545 CVE-2026-31546                      CVE-2026-31548 CVE-2026-31549 CVE-2026-31550 CVE-2026-31551                      CVE-2026-31552 CVE-2026-31554 CVE-2026-31555 CVE-2026-31556                      CVE-2026-31557 CVE-2026-31558 CVE-2026-31559 CVE-2026-31561                      CVE-2026-31563 CVE-2026-31565 CVE-2026-31566 CVE-2026-31570                      CVE-2026-31575 CVE-2026-31576 CVE-2026-31577 CVE-2026-31578                      CVE-2026-31580 CVE-2026-31581 CVE-2026-31582 CVE-2026-31583                      CVE-2026-31584 CVE-2026-31585 CVE-2026-31586 CVE-2026-31587                      CVE-2026-31588 CVE-2026-31590 CVE-2026-31593 CVE-2026-31594                      CVE-2026-31595 CVE-2026-31596 CVE-2026-31597 CVE-2026-31598                      CVE-2026-31599 CVE-2026-31602 CVE-2026-31603 CVE-2026-31604                      CVE-2026-31605 CVE-2026-31606 CVE-2026-31607 CVE-2026-31610                      CVE-2026-31611 CVE-2026-31612 CVE-2026-31614 CVE-2026-31615                      CVE-2026-31616 CVE-2026-31617 CVE-2026-31618 CVE-2026-31619                      CVE-2026-31622 CVE-2026-31623 CVE-2026-31624 CVE-2026-31625                      CVE-2026-31626 CVE-2026-31627 CVE-2026-31628 CVE-2026-31629                      CVE-2026-31634 CVE-2026-31637 CVE-2026-31638 CVE-2026-31639                      CVE-2026-31642 CVE-2026-31644 CVE-2026-31645 CVE-2026-31646                      CVE-2026-31647 CVE-2026-31648 CVE-2026-31649 CVE-2026-31651                      CVE-2026-31655 CVE-2026-31656 CVE-2026-31657 CVE-2026-31658                      CVE-2026-31659 CVE-2026-31660 CVE-2026-31661 CVE-2026-31662                      CVE-2026-31664 CVE-2026-31665 CVE-2026-31666 CVE-2026-31667                      CVE-2026-31668 CVE-2026-31669 CVE-2026-31670 CVE-2026-31671                      CVE-2026-31672 CVE-2026-31673 CVE-2026-31674 CVE-2026-31675                      CVE-2026-31676 CVE-2026-31677 CVE-2026-31678 CVE-2026-31679                      CVE-2026-31680 CVE-2026-31681 CVE-2026-31682 CVE-2026-31683                      CVE-2026-31684 CVE-2026-31685 CVE-2026-31686 CVE-2026-31689                      CVE-2026-31693 CVE-2026-31786 CVE-2026-31787 CVE-2026-31788

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (trixie), these problems have been fixed in     version 6.12.85-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: kernel: be more careful about
    dup_mmap() failures and uprobe registering If a memory allocation fails during dup_mmap(), the maple tree
    can be left in an unsafe state for other iterators besides the exit path. All the locks are dropped before
    the exit_mmap() call (in mm/mmap.c), but the incomplete mm_struct can be reached through (at least) the
    rmap finding the vmas which have a pointer back to the mm_struct. Up to this point, there have been no
    issues with being able to find an mm_struct that was only partially initialised. Syzbot was able to make
    the incomplete mm_struct fail with recent forking changes, so it has been proven unsafe to use the
    mm_struct that hasn't been initialised, as referenced in the link below. Although 8ac662f5da19f ("fork:
    avoid inappropriate uprobe access to invalid mm") fixed the uprobe access, it does not completely remove
    the race. This patch sets the MMF_OOM_SKIP to avoid the iteration of the vmas on the oom side (even though
    this is extremely unlikely to be selected as an oom victim in the race window), and sets MMF_UNSTABLE to
    avoid other potential users from using a partially initialised mm_struct. When registering vmas for
    uprobe, skip the vmas in an mm that is marked unstable. Modifying a vma in an unstable mm may cause issues
    if the mm isn't fully initialised. (CVE-2025-21709)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-994 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do proper folio cleanup when cow_file_range() failed (CVE-2024-57976)

    In the Linux kernel, the following vulnerability has been resolved:

    kernel: be more careful about dup_mmap() failures and uprobe registering (CVE-2025-21709)

    In the Linux kernel, the following vulnerability has been resolved:

    block: fix queue freeze vs limits lock order in sysfs store methods (CVE-2025-21807)

    In the Linux kernel, the following vulnerability has been resolved:

    block: mark GFP_NOIO around sysfs ->store() (CVE-2025-21817)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (CVE-2025-21833)

    In the Linux kernel, the following vulnerability has been resolved:

    net: better track kernel sockets lifetime (CVE-2025-21884)

    In the Linux kernel, the following vulnerability has been resolved:

    bnxt_en: Mask the bd_cnt field in the TX BD properly (CVE-2025-22108)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: goto right label 'out_mmap_sem' in ext4_setattr() (CVE-2025-22120)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)

    In the Linux kernel, the following vulnerability has been resolved:

    vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (CVE-2025-37799)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: fix potential NULL pointer dereference in dev_uevent() (CVE-2025-37800)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Keep write operations atomic (CVE-2025-37806)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix kmemleak warning for percpu hashmap (CVE-2025-37807)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: null - Use spin lock instead of mutex (CVE-2025-37808)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: typec: class: Fix NULL pointer access (CVE-2025-37809)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: xhci: Fix invalid pointer dereference in Etron workaround (CVE-2025-37813)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORT (CVE-2025-37814)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (CVE-2025-37819)

    In the Linux kernel, the following vulnerability has been resolved:

    xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (CVE-2025-37820)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash (CVE-2025-37821)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CVE-2025-37823)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: zoned: return EIO on RAID1 block group write pointer mismatch (CVE-2025-37827)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/vmscan: don't try to reclaim hwpoison folio (CVE-2025-37834)

    In the Linux kernel, the following vulnerability has been resolved:

    netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS (CVE-2025-37876)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu: Clear iommu-dma ops on cleanup (CVE-2025-37877)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init (CVE-2025-37878)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (CVE-2025-37882)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Fix deadlock between rcu_tasks_trace and event_mutex. (CVE-2025-37884)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Reset IRTE to host control if *new* route isn't postable (CVE-2025-37885)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (CVE-2025-37888)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CVE-2025-37890)

    In the Linux kernel, the following vulnerability has been resolved:

    net: use sock_gen_put() when sk_state is TCP_TIME_WAIT (CVE-2025-37894)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu: Fix two issues in iommu_copy_struct_from_user() (CVE-2025-37900)

    In the Linux kernel, the following vulnerability has been resolved:

    mm, slab: clean up slab->obj_exts always (CVE-2025-37908)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: qfq: Fix double list add in class with netem as child qdisc (CVE-2025-37913)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: ets: Fix double list add in class with netem as child qdisc (CVE-2025-37914)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: drr: Fix double list add in class with netem as child qdisc (CVE-2025-37915)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: Fix race condition in AF_XDP generic RX path (CVE-2025-37920)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: vnifilter: Fix unlocked deletion of default FDB entry (CVE-2025-37921)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix oob write in trace_seq_to_buffer() (CVE-2025-37923)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid (CVE-2025-37927)

    In the Linux kernel, the following vulnerability has been resolved:

    dm-bufio: don't schedule in atomic context (CVE-2025-37928)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (CVE-2025-37929)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: adjust subpage bit start based on sectorsize (CVE-2025-37931)

    In the Linux kernel, the following vulnerability has been resolved:

    sch_htb: make htb_qlen_notify() idempotent (CVE-2025-37932)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. (CVE-2025-37936)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Verify event formats that have %*p.. (CVE-2025-37938)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (CVE-2025-37948)

    In the Linux kernel, the following vulnerability has been resolved:

    xenbus: Use kref to track req lifetime (CVE-2025-37949)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: Avoid race in open_cached_dir with lease breaks (CVE-2025-37954)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-net: free xsk_buffs on error in virtnet_xsk_pool_enable() (CVE-2025-37955)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception (CVE-2025-37957)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Scrub packet on bpf_redirect_peer (CVE-2025-37959)

    In the Linux kernel, the following vulnerability has been resolved:

    memblock: Accept allocated memory before use in memblock_double_array() (CVE-2025-37960)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvs: fix uninit-value for saddr in do_output_route4 (CVE-2025-37961)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (CVE-2025-37963)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/mm: Eliminate window where TLB flushes may be inadvertently skipped (CVE-2025-37964)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: typec: class: Invalidate USB device pointers on partner unregistration (CVE-2025-37986)

    In the Linux kernel, the following vulnerability has been resolved:

    fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() (CVE-2025-37988)

    In the Linux kernel, the following vulnerability has been resolved:

    net: phy: leds: fix memory leak (CVE-2025-37989)

    In the Linux kernel, the following vulnerability has been resolved:

    module: ensure that kobject_put() is safe for module type kobjects (CVE-2025-37995)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ipset: fix region locking in hash types (CVE-2025-37997)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: Fix unsafe attribute parsing in output_userspace() (CVE-2025-37998)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() (CVE-2025-37999)

    In the Linux kernel, the following vulnerability has been resolved:

    sch_hfsc: make hfsc_qlen_notify() idempotent (CVE-2025-38177)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-984 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do proper folio cleanup when cow_file_range() failed (CVE-2024-57976)

    In the Linux kernel, the following vulnerability has been resolved:

    kernel: be more careful about dup_mmap() failures and uprobe registering (CVE-2025-21709)

    In the Linux kernel, the following vulnerability has been resolved:

    block: fix queue freeze vs limits lock order in sysfs store methods (CVE-2025-21807)

    In the Linux kernel, the following vulnerability has been resolved:

    block: mark GFP_NOIO around sysfs ->store() (CVE-2025-21817)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (CVE-2025-21833)

    In the Linux kernel, the following vulnerability has been resolved:

    net: better track kernel sockets lifetime (CVE-2025-21884)

    In the Linux kernel, the following vulnerability has been resolved:

    bnxt_en: Mask the bd_cnt field in the TX BD properly (CVE-2025-22108)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - kernel: be more careful about dup_mmap() failures and uprobe registering If a memory allocation fails     during dup_mmap(), the maple tree can be left in an unsafe state for other iterators besides the exit     path. All the locks are dropped before the exit_mmap() call (in mm/mmap.c), but the incomplete mm_struct     can be reached through (at least) the rmap finding the vmas which have a pointer back to the mm_struct. Up     to this point, there have been no issues with being able to find an mm_struct that was only partially     initialised. Syzbot was able to make the incomplete mm_struct fail with recent forking changes, so it has     been proven unsafe to use the mm_struct that hasn't been initialised, as referenced in the link below.
    Although 8ac662f5da19f (fork: avoid inappropriate uprobe access to invalid mm) fixed the uprobe access,     it does not completely remove the race. This patch sets the MMF_OOM_SKIP to avoid the iteration of the     vmas on the oom side (even though this is extremely unlikely to be selected as an oom victim in the race     window), and sets MMF_UNSTABLE to avoid other potential users from using a partially initialised     mm_struct. When registering vmas for uprobe, skip the vmas in an mm that is marked unstable. Modifying a     vma in an unstable mm may cause issues if the mm isn't fully initialised. (CVE-2025-21709)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
325292	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50372)	Nessus	Oracle Linux Local Security Checks	high
318365	Photon OS 5.0: Linux PHSA-2026-5.0-0849	Nessus	PhotonOS Local Security Checks	high
311299	Debian dsa-6238 : ata-modules-6.12.74+deb13+1-armmp-di - security update	Nessus	Debian Local Security Checks	high
428238	Bottlerocket: bottlerocket-kernel-6.12, kernel-6.12: security update to 6.12.29	Tenable Cloud Security	Bottlerocket Local Security Checks	medium
428238	Bottlerocket: bottlerocket-kernel-6.12, kernel-6.12: security update to 6.12.29	Tenable Self-Hosted Container Security	Bottlerocket Local Security Checks	medium
238280	Amazon Linux 2023 : bpftool, kernel6.12, kernel6.12-modules-extra (ALAS2023-2025-994)	Nessus	Amazon Linux Local Security Checks	high
237679	Amazon Linux 2023 : bpftool, kernel6.12, kernel6.12-modules-extra (ALAS2023-2025-984)	Nessus	Amazon Linux Local Security Checks	medium
231031	Linux Distros Unpatched Vulnerability : CVE-2025-21709	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-21709

medium

Tenable Plugins

high

high

high

medium

medium

high

medium

medium