In the Linux kernel, the following vulnerability has been resolved: can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet This patch switches the timer to HRTIMER_MODE_SOFT, which executed the timer callback in softirq context and removes the hrtimer_tasklet.

tuxcare CENTOS8.4:CLSA-2026:1791858083: kernel: Fix of 94 CVEs (Critical)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1791852988 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: idle: Check     acpi_fetch_acpi_dev() return value The return value of acpi_fetch_acpi_dev() could be NULL, which would     cause a NULL pointer dereference to occur in acpi_device_hid(). [ rjw: Subject and changelog edits, added     empty line after if () ] (CVE-2022-50327)

  - In the Linux kernel, the following vulnerability has been resolved: ext4: fix null-ptr-deref in     ext4_write_info I caught a null-ptr-deref bug as follows:
    ================================================================== KASAN: null-ptr-deref in range     [0x0000000000000068-0x000000000000006f] CPU: 1 PID: 1589 Comm: umount Not tainted 5.10.0-02219-dirty #339     RIP: 0010:ext4_write_info+0x53/0x1b0 [...] Call Trace: dquot_writeback_dquots+0x341/0x9a0     ext4_sync_fs+0x19e/0x800 __sync_filesystem+0x83/0x100 sync_filesystem+0x89/0xf0     generic_shutdown_super+0x79/0x3e0 kill_block_super+0xa1/0x110 deactivate_locked_super+0xac/0x130     deactivate_super+0xb6/0xd0 cleanup_mnt+0x289/0x400 __cleanup_mnt+0x16/0x20 task_work_run+0x11c/0x1c0     exit_to_user_mode_prepare+0x203/0x210 syscall_exit_to_user_mode+0x5b/0x3a0 do_syscall_64+0x59/0x70     entry_SYSCALL_64_after_hwframe+0x44/0xa9     ================================================================== Above issue may happen as follows:
    ------------------------------------- exit_to_user_mode_prepare task_work_run __cleanup_mnt cleanup_mnt     deactivate_super deactivate_locked_super kill_block_super generic_shutdown_super shrink_dcache_for_umount     dentry = sb->s_root sb->s_root = NULL <--- Here set NULL sync_filesystem __sync_filesystem     sb->s_op->sync_fs > ext4_sync_fs dquot_writeback_dquots sb->dq_op->write_info > ext4_write_info     ext4_journal_start(d_inode(sb->s_root), EXT4_HT_QUOTA, 2) d_inode(sb->s_root) s_root->d_inode <--- Null     pointer dereference To solve this problem, we use ext4_journal_start_sb directly to avoid s_root being     used. (CVE-2022-50344)

  - In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix null-ptr-deref in     vkms_release() A null-ptr-deref is triggered when it tries to destroy the workqueue in     vkms->output.composer_workq in vkms_release(). KASAN: null-ptr-deref in range     [0x0000000000000118-0x000000000000011f] CPU: 5 PID: 17193 Comm: modprobe Not tainted     6.0.0-11331-gd465bff130bf #24 RIP: 0010:destroy_workqueue+0x2f/0x710 ... Call Trace: <TASK> ?     vkms_config_debugfs_init+0x50/0x50 [vkms] __devm_drm_dev_alloc+0x15a/0x1c0 [drm] vkms_init+0x245/0x1000     [vkms] do_one_initcall+0xd0/0x4f0 do_init_module+0x1a4/0x680 load_module+0x6249/0x7110
    __do_sys_finit_module+0x140/0x200 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The     reason is that an OOM happened which triggers the destroy of the workqueue, however, the workqueue is     alloced in the later process, thus a null-ptr-deref happened. A simple call graph is shown as below:
    vkms_init() vkms_create() devm_drm_dev_alloc() __devm_drm_dev_alloc() devm_drm_dev_init()     devm_add_action_or_reset() devm_add_action() # an error happened devm_drm_dev_init_release() drm_dev_put()     kref_put() drm_dev_release() vkms_release() destroy_workqueue() # null-ptr-deref happened     vkms_modeset_init() vkms_output_init() vkms_crtc_init() # where the workqueue get allocated Fix this by     checking if composer_workq is NULL before passing it to the destroy_workqueue() in vkms_release().
    (CVE-2022-50369)

  - In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4.1, fix double     svc_xprt_put on rpc_create failure On error situation `clp->cl_cb_conn.cb_xprt` should not be given a     reference to the xprt otherwise both client cleanup and the error handling path of the caller call to put     it. Better to delay handing over the reference to a later branch. [ 72.530665] refcount_t: underflow; use-     after-free. [ 72.531933] WARNING: CPU: 0 PID: 173 at lib/refcount.c:28 refcount_warn_saturate+0xcf/0x120 [     72.533075] Modules linked in: nfsd(OE) nfsv4(OE) nfsv3(OE) nfs(OE) lockd(OE) compat_nfs_ssc(OE)     nfs_acl(OE) rpcsec_gss_krb5(OE) auth_rpcgss(OE) rpcrdma(OE) dns_resolver fscache netfs grace rdma_cm iw_cm     ib_cm sunrpc(OE) mlx5_ib mlx5_core mlxfw pci_hyperv_intf ib_uverbs ib_core xt_MASQUERADE     nf_conntrack_netlink nft_counter xt_addrtype nft_compat br_netfilter bridge stp llc nft_reject_inet     nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6     nf_defrag_ipv4 ip_set overlay nf_tables nfnetlink crct10dif_pclmul crc32_pclmul ghash_clmulni_intel xfs     serio_raw virtio_net virtio_blk net_failover failover fuse [last unloaded: sunrpc] [ 72.540389] CPU: 0     PID: 173 Comm: kworker/u16:5 Tainted: G OE 5.15.82-dan #1 [ 72.541511] Hardware name: Red Hat KVM/RHEL-AV,     BIOS 1.16.0-3.module+el8.7.0+1084+97b81f61 04/01/2014 [ 72.542717] Workqueue: nfsd4_callbacks     nfsd4_run_cb_work [nfsd] [ 72.543575] RIP: 0010:refcount_warn_saturate+0xcf/0x120 [ 72.544299] Code: 55 00     0f 0b 5d e9 01 50 98 00 80 3d 75 9e 39 08 00 0f 85 74 ff ff ff 48 c7 c7 e8 d1 60 8e c6 05 61 9e 39 08 01     e8 f6 51 55 00 <0f> 0b 5d e9 d9 4f 98 00 80 3d 4b 9e 39 08 00 0f 85 4c ff ff ff 48 [ 72.546666] RSP:
    0018:ffffb3f841157cf0 EFLAGS: 00010286 [ 72.547393] RAX: 0000000000000026 RBX: ffff89ac6231d478 RCX:
    0000000000000000 [ 72.548324] RDX: ffff89adb7c2c2c0 RSI: ffff89adb7c205c0 RDI: ffff89adb7c205c0 [     72.549271] RBP: ffffb3f841157cf0 R08: 0000000000000000 R09: c0000000ffefffff [ 72.550209] R10:
    0000000000000001 R11: ffffb3f841157ad0 R12: ffff89ac6231d180 [ 72.551142] R13: ffff89ac6231d478 R14:
    ffff89ac40c06180 R15: ffff89ac6231d4b0 [ 72.552089] FS: 0000000000000000(0000) GS:ffff89adb7c00000(0000)     knlGS:0000000000000000 [ 72.553175] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 72.553934] CR2:
    0000563a310506a8 CR3: 0000000109a66000 CR4: 0000000000350ef0 [ 72.554874] Call Trace: [ 72.555278] <TASK>     [ 72.555614] svc_xprt_put+0xaf/0xe0 [sunrpc] [ 72.556276] nfsd4_process_cb_update.isra.11+0xb7/0x410     [nfsd] [ 72.557087] ? update_load_avg+0x82/0x610 [ 72.557652] ? cpuacct_charge+0x60/0x70 [ 72.558212] ?     dequeue_entity+0xdb/0x3e0 [ 72.558765] ? queued_spin_unlock+0x9/0x20 [ 72.559358]     nfsd4_run_cb_work+0xfc/0x270 [nfsd] [ 72.560031] process_one_work+0x1df/0x390 [ 72.560600]     worker_thread+0x37/0x3b0 [ 72.561644] ? process_one_work+0x390/0x390 [ 72.562247] kthread+0x12f/0x150 [     72.562710] ? set_kthread_struct+0x50/0x50 [ 72.563309] ret_from_fork+0x22/0x30 [ 72.563818] </TASK> [     72.564189] ---[ end trace 031117b1c72ec616 ]--- [ 72.566019] list_add corruption. next->prev should be     prev (ffff89ac4977e538), but was ffff89ac4763e018. (next=ffff89ac4763e018). [ 72.567647] ------------[ cut     here ]------------ (CVE-2022-50401)

  - In the Linux kernel, the following vulnerability has been resolved: bpf: Propagate error from     htab_lock_bucket() to userspace In __htab_map_lookup_and_delete_batch() if htab_lock_bucket() returns
    -EBUSY, it will go to next bucket. Going to next bucket may not only skip the elements in current bucket     silently, but also incur out-of-bound memory access or expose kernel memory to userspace if current     bucket_cnt is greater than bucket_size or zero. Fixing it by stopping batch operation and returning -EBUSY     when htab_lock_bucket() fails, and the application can retry or skip the busy batch as needed.
    (CVE-2022-50490)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1545 advisory.

    This advisory aggregates security fixes for the kernel SRPM in CIQ LTS 8.6. It addresses 12 CVEs:
    CVE-2026-53006, CVE-2026-17523, CVE-2026-68121, CVE-2026-80844, CVE-2026-53196, and 7 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_55765 advisory.

    * kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

    * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)

    * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

    * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

    * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

    * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

    * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

    * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)

    * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

    Bug Fix(es) and Enhancement(s):

    * Backport sched/deadline: Fix bandwidth reclaim equation in GRUB to Rocky Linux 8.10 (JIRA:Rocky     Linux-189997)

    * vhost: reset the vring metadata cache on vring reconfiguration [rhel-8.10.z] (JIRA:Rocky Linux-224556)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_55764 advisory.

    * kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

    * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)

    * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

    * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

    * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

    * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

    * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

    * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)

    * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

    Bug Fix(es) and Enhancement(s):

    * Backport sched/deadline: Fix bandwidth reclaim equation in GRUB to Rocky Linux 8.10 (JIRA:Rocky     Linux-189997)

    * vhost: reset the vring metadata cache on vring reconfiguration [rhel-8.10.z] (JIRA:Rocky Linux-224556)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65710 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: dm btree remove: fix use after free in rebalance_children() (CVE-2021-47600)

    * kernel: netfilter: nf_tables: don't skip expired elements during walk (CVE-2023-52924)

    * kernel: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CVE-2026-31411)

    * kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120)

    * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)

    * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)

    * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)

    * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)

    * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

    * kernel: packet: use consistent hard_header_len in non-ring send paths ()

    Bug Fix(es) and Enhancement(s):

    * vhost: reset the vring metadata cache on vring reconfiguration (JIRA:RHEL-224603)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65711 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)

    * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)

    * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)

    * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)

    * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

    * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)

    * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

    * kernel: packet: use consistent hard_header_len in non-ring send paths ()

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1750:72 advisory.

    * kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)
      * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
      * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)
      * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
      * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
      * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
      * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
      * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
      * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)
      * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61932 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)

    * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()     (CVE-2026-64002)

    * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

    * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55764 advisory.

    - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991}
    - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009}
    - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327]     {CVE-2026-43206}
    - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI     Backport Bot) [RHEL-222576] {CVE-2026-64219}
    - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879}
    - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884}
    - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662]     {CVE-2026-53329}
    - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680]     {CVE-2026-53136}
    - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino)     [RHEL-226551] {CVE-2025-39902}
    - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374}
    - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711]     {CVE-2026-17523}
    - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711]     {CVE-2026-17523}
    - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523}
    - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523}
    - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711]     {CVE-2026-17523}
    - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711]     {CVE-2026-17523}
    - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523}
    - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711]     {CVE-2026-17523}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55764 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

    * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)

    * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

    * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

    * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

    * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

    * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

    * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)

    * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

    Bug Fix(es) and Enhancement(s):

    * Backport sched/deadline: Fix bandwidth reclaim equation in GRUB to RHEL 8.10 (JIRA:RHEL-189997)

    * vhost: reset the vring metadata cache on vring reconfiguration [rhel-8.10.z] (JIRA:RHEL-224556)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55764 advisory.

    * kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)
      * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
      * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)
      * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
      * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
      * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
      * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
      * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
      * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)
      * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)


    Bug Fix(es) and Enhancement(s):

      * Backport sched/deadline: Fix bandwidth reclaim equation in GRUB to AlmaLinux 8.10     (JIRA:AlmaLinux-189997)
      * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-8.10.z]     (JIRA:AlmaLinux-224556)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55765 advisory.

    * kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)
      * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
      * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)
      * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
      * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
      * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
      * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
      * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
      * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)
      * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)


    Bug Fix(es) and Enhancement(s):

      * Backport sched/deadline: Fix bandwidth reclaim equation in GRUB to AlmaLinux 8.10     (JIRA:AlmaLinux-189997)
      * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-8.10.z]     (JIRA:AlmaLinux-224556)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55764 advisory.

    * kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

    * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)

    * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

    * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

    * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

    * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

    * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

    * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)

    * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

    Bug Fix(es) and Enhancement(s):

    * Backport sched/deadline: Fix bandwidth reclaim equation in GRUB to Rocky Linux 8.10 (JIRA:Rocky     Linux-189997)

    * vhost: reset the vring metadata cache on vring reconfiguration [rhel-8.10.z] (JIRA:Rocky Linux-224556)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55765 advisory.

    * kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

    * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)

    * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

    * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

    * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

    * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

    * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

    * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)

    * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

    Bug Fix(es) and Enhancement(s):

    * Backport sched/deadline: Fix bandwidth reclaim equation in GRUB to Rocky Linux 8.10 (JIRA:Rocky     Linux-189997)

    * vhost: reset the vring metadata cache on vring reconfiguration [rhel-8.10.z] (JIRA:Rocky Linux-224556)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55765 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)

    * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

    * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)

    * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

    * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

    * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

    * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

    * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

    * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async     (CVE-2026-64219)

    * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

    Bug Fix(es) and Enhancement(s):

    * Backport sched/deadline: Fix bandwidth reclaim equation in GRUB to RHEL 8.10 (JIRA:RHEL-189997)

    * vhost: reset the vring metadata cache on vring reconfiguration [rhel-8.10.z] (JIRA:RHEL-224556)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet This patch switches the timer to     HRTIMER_MODE_SOFT, which executed the timer callback in softirq context and removes the hrtimer_tasklet.
    (CVE-2026-17523)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365299	CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1791852988)	Nessus	CentOS Local Security Checks	Local	high
356833	Rocky Linux 8.6 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ciqsa-2026_1545)	Nessus	Rocky Linux Local Security Checks	Local	medium
356669	Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc Multiple Vulnerabilities (crlsa-2026_55765)	Nessus	Rocky Linux Local Security Checks	Local	high
356360	Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (crlsa-2026_55764)	Nessus	Rocky Linux Local Security Checks	Local	high
343934	RHEL 8 : kernel (RHSA-2026:65710)	Nessus	Red Hat Local Security Checks	Local	high
343933	RHEL 8 : kernel (RHSA-2026:65711)	Nessus	Red Hat Local Security Checks	Local	medium
342592	MiracleLinux 8 : kernel-4.18.0-553.156.1.el8_10 (AXSA:2026-1750:72)	Nessus	Miracle Linux Local Security Checks	Local	high
342148	RHEL 8 : kernel (RHSA-2026:61932)	Nessus	Red Hat Local Security Checks	Local	critical
338777	Oracle Linux 8 : kernel (ELSA-2026-55764)	Nessus	Oracle Linux Local Security Checks	Local	high
337336	RHEL 8 : kernel (RHSA-2026:55764)	Nessus	Red Hat Local Security Checks	Local	high
337148	AlmaLinux 8 : kernel (ALSA-2026:55764)	Nessus	Alma Linux Local Security Checks	Local	high
337146	AlmaLinux 8 : kernel-rt (ALSA-2026:55765)	Nessus	Alma Linux Local Security Checks	Local	high
337100	RockyLinux 8 : kernel (RLSA-2026:55764)	Nessus	Rocky Linux Local Security Checks	Local	high
337095	RockyLinux 8 : kernel-rt (RLSA-2026:55765)	Nessus	Rocky Linux Local Security Checks	Local	high
335994	RHEL 8 : kernel-rt (RHSA-2026:55765)	Nessus	Red Hat Local Security Checks	Local	high
330170	Linux Distros Unpatched Vulnerability : CVE-2026-17523	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-17523

high

Tenable Plugins

Coming Soon

high

medium

high

high

high

medium

high

critical

high

high

high

high

high

high

high

high