In the Linux kernel, the following vulnerability has been resolved: ipv6: annotate data-race in ndisc_router_discovery() syzbot found that ndisc_router_discovery() could read and write in6_dev->ra_mtu without holding a lock [1] This looks fine, IFLA_INET6_RA_MTU is best effort. Add READ_ONCE()/WRITE_ONCE() to document the race. Note that we might also reject illegal MTU values (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) in a future patch. [1] BUG: KCSAN: data-race in ndisc_router_discovery / ndisc_router_discovery read to 0xffff888119809c20 of 4 bytes by task 25817 on cpu 1: ndisc_router_discovery+0x151d/0x1c90 net/ipv6/ndisc.c:1558 ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841 icmpv6_rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989 ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438 ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500 ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590 dst_input include/net/dst.h:474 [inline] ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79 ... write to 0xffff888119809c20 of 4 bytes by task 25816 on cpu 0: ndisc_router_discovery+0x155a/0x1c90 net/ipv6/ndisc.c:1559 ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841 icmpv6_rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989 ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438 ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500 ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590 dst_input include/net/dst.h:474 [inline] ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79 ... value changed: 0x00000000 -> 0xe5400659

The remote Ubuntu Pro Realtime 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8186-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - Block layer subsystem;

    - Drivers core;

    - Bluetooth drivers;

    - DMA engine subsystem;

    - GPU drivers;

    - HID subsystem;

    - Intel Trace Hub HW tracing drivers;

    - IIO ADC drivers;

    - IRQ chip drivers;

    - Modular ISDN driver;

    - LED subsystem;

    - UACCE accelerator framework;

    - Ethernet bonding driver;

    - Network drivers;

    - STMicroelectronics network drivers;

    - Ethernet team driver;

    - NVME drivers;

    - PHY drivers;

    - SLIMbus drivers;

    - W1 Dallas's 1-wire bus driver;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - Ext4 file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - SMB network file system;

    - NFC subsystem;

    - BPF subsystem;

    - IRQ subsystem;

    - Memory management;

    - Bluetooth subsystem;

    - CAN network layer;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - L2TP protocol;

    - NET/ROM layer;

    - Network traffic control;

    - SCTP protocol;

    - TLS protocol;

    - XFRM subsystem;

    - Creative Sound Blaster X-Fi driver;

    - USB sound devices; (CVE-2023-53421, CVE-2023-53520, CVE-2023-53662, CVE-2023-54207, CVE-2025-38057,     CVE-2025-38125, CVE-2025-38232, CVE-2025-38408, CVE-2025-38591, CVE-2025-40149, CVE-2025-40164,     CVE-2025-68211, CVE-2025-68340, CVE-2025-68365, CVE-2025-68725, CVE-2025-68817, CVE-2025-71080,     CVE-2025-71162, CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71190,     CVE-2025-71191, CVE-2025-71194, CVE-2025-71196, CVE-2025-71197, CVE-2025-71199, CVE-2026-22997,     CVE-2026-22998, CVE-2026-22999, CVE-2026-23001, CVE-2026-23003, CVE-2026-23011, CVE-2026-23026,     CVE-2026-23033, CVE-2026-23037, CVE-2026-23038, CVE-2026-23049, CVE-2026-23056, CVE-2026-23058,     CVE-2026-23061, CVE-2026-23063, CVE-2026-23064, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075,     CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085,     CVE-2026-23087, CVE-2026-23089, CVE-2026-23090, CVE-2026-23091, CVE-2026-23093, CVE-2026-23095,     CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23103,     CVE-2026-23105, CVE-2026-23108, CVE-2026-23119, CVE-2026-23120, CVE-2026-23121, CVE-2026-23124,     CVE-2026-23125, CVE-2026-23128, CVE-2026-23133, CVE-2026-23145, CVE-2026-23146, CVE-2026-23150,     CVE-2026-23164, CVE-2026-23167, CVE-2026-23170, CVE-2026-23209)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8187-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - Block layer subsystem;

    - Drivers core;

    - Bluetooth drivers;

    - DMA engine subsystem;

    - GPU drivers;

    - HID subsystem;

    - Intel Trace Hub HW tracing drivers;

    - IIO ADC drivers;

    - IRQ chip drivers;

    - Modular ISDN driver;

    - LED subsystem;

    - UACCE accelerator framework;

    - Ethernet bonding driver;

    - Network drivers;

    - STMicroelectronics network drivers;

    - Ethernet team driver;

    - NVME drivers;

    - PHY drivers;

    - SLIMbus drivers;

    - W1 Dallas's 1-wire bus driver;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - Ext4 file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - SMB network file system;

    - NFC subsystem;

    - BPF subsystem;

    - IRQ subsystem;

    - Memory management;

    - Bluetooth subsystem;

    - CAN network layer;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - L2TP protocol;

    - NET/ROM layer;

    - Network traffic control;

    - SCTP protocol;

    - TLS protocol;

    - XFRM subsystem;

    - Creative Sound Blaster X-Fi driver;

    - USB sound devices; (CVE-2023-53421, CVE-2023-53520, CVE-2023-53662, CVE-2023-54207, CVE-2025-38057,     CVE-2025-38125, CVE-2025-38232, CVE-2025-38408, CVE-2025-38591, CVE-2025-40149, CVE-2025-40164,     CVE-2025-68211, CVE-2025-68340, CVE-2025-68365, CVE-2025-68725, CVE-2025-68817, CVE-2025-71080,     CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71190, CVE-2025-71191,     CVE-2025-71194, CVE-2025-71196, CVE-2025-71197, CVE-2025-71199, CVE-2026-22997, CVE-2026-22998,     CVE-2026-22999, CVE-2026-23001, CVE-2026-23003, CVE-2026-23011, CVE-2026-23026, CVE-2026-23033,     CVE-2026-23037, CVE-2026-23038, CVE-2026-23049, CVE-2026-23056, CVE-2026-23058, CVE-2026-23061,     CVE-2026-23063, CVE-2026-23064, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076,     CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23087,     CVE-2026-23089, CVE-2026-23090, CVE-2026-23091, CVE-2026-23093, CVE-2026-23095, CVE-2026-23096,     CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23103, CVE-2026-23105,     CVE-2026-23108, CVE-2026-23119, CVE-2026-23120, CVE-2026-23121, CVE-2026-23124, CVE-2026-23125,     CVE-2026-23128, CVE-2026-23133, CVE-2026-23145, CVE-2026-23146, CVE-2026-23150, CVE-2026-23164,     CVE-2026-23167, CVE-2026-23170, CVE-2026-23209)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8188-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Drivers core;

    - Bluetooth drivers;

    - DMA engine subsystem;

    - GPU drivers;

    - HID subsystem;

    - Intel Trace Hub HW tracing drivers;

    - IIO ADC drivers;

    - IRQ chip drivers;

    - Modular ISDN driver;

    - LED subsystem;

    - UACCE accelerator framework;

    - Ethernet bonding driver;

    - Network drivers;

    - STMicroelectronics network drivers;

    - Ethernet team driver;

    - NVME drivers;

    - PHY drivers;

    - SLIMbus drivers;

    - W1 Dallas's 1-wire bus driver;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - Ext4 file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - SMB network file system;

    - NFC subsystem;

    - BPF subsystem;

    - IRQ subsystem;

    - Memory management;

    - Bluetooth subsystem;

    - CAN network layer;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - L2TP protocol;

    - Netfilter;

    - NET/ROM layer;

    - Network traffic control;

    - SCTP protocol;

    - TLS protocol;

    - XFRM subsystem;

    - Creative Sound Blaster X-Fi driver;

    - USB sound devices; (CVE-2023-53421, CVE-2023-53520, CVE-2023-53662, CVE-2023-54207, CVE-2025-37849,     CVE-2025-38057, CVE-2025-38125, CVE-2025-38232, CVE-2025-38408, CVE-2025-38591, CVE-2025-40149,     CVE-2025-40164, CVE-2025-68211, CVE-2025-68340, CVE-2025-68365, CVE-2025-68725, CVE-2025-68817,     CVE-2025-71162, CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71190,     CVE-2025-71191, CVE-2025-71194, CVE-2025-71196, CVE-2025-71197, CVE-2025-71199, CVE-2026-22997,     CVE-2026-22998, CVE-2026-22999, CVE-2026-23001, CVE-2026-23003, CVE-2026-23011, CVE-2026-23026,     CVE-2026-23033, CVE-2026-23037, CVE-2026-23038, CVE-2026-23049, CVE-2026-23056, CVE-2026-23058,     CVE-2026-23060, CVE-2026-23061, CVE-2026-23063, CVE-2026-23064, CVE-2026-23071, CVE-2026-23073,     CVE-2026-23074, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083,     CVE-2026-23084, CVE-2026-23085, CVE-2026-23087, CVE-2026-23089, CVE-2026-23090, CVE-2026-23091,     CVE-2026-23093, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099,     CVE-2026-23101, CVE-2026-23103, CVE-2026-23105, CVE-2026-23108, CVE-2026-23111, CVE-2026-23119,     CVE-2026-23120, CVE-2026-23121, CVE-2026-23124, CVE-2026-23125, CVE-2026-23128, CVE-2026-23133,     CVE-2026-23145, CVE-2026-23146, CVE-2026-23150, CVE-2026-23164, CVE-2026-23167, CVE-2026-23170,     CVE-2026-23209)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8180-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - Block layer subsystem;

    - Drivers core;

    - Bluetooth drivers;

    - DMA engine subsystem;

    - GPU drivers;

    - HID subsystem;

    - Intel Trace Hub HW tracing drivers;

    - IIO ADC drivers;

    - IRQ chip drivers;

    - Modular ISDN driver;

    - LED subsystem;

    - UACCE accelerator framework;

    - Ethernet bonding driver;

    - Network drivers;

    - STMicroelectronics network drivers;

    - Ethernet team driver;

    - NVME drivers;

    - PHY drivers;

    - SLIMbus drivers;

    - W1 Dallas's 1-wire bus driver;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - Ext4 file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - SMB network file system;

    - NFC subsystem;

    - BPF subsystem;

    - IRQ subsystem;

    - Memory management;

    - Bluetooth subsystem;

    - CAN network layer;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - L2TP protocol;

    - NET/ROM layer;

    - Network traffic control;

    - SCTP protocol;

    - TLS protocol;

    - XFRM subsystem;

    - Creative Sound Blaster X-Fi driver;

    - USB sound devices; (CVE-2023-53421, CVE-2023-53520, CVE-2023-53662, CVE-2023-54207, CVE-2025-38057,     CVE-2025-38125, CVE-2025-38232, CVE-2025-38408, CVE-2025-38591, CVE-2025-40149, CVE-2025-40164,     CVE-2025-68211, CVE-2025-68340, CVE-2025-68365, CVE-2025-68725, CVE-2025-68817, CVE-2025-71162,     CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71190, CVE-2025-71191,     CVE-2025-71194, CVE-2025-71196, CVE-2025-71197, CVE-2025-71199, CVE-2026-22997, CVE-2026-22998,     CVE-2026-22999, CVE-2026-23001, CVE-2026-23003, CVE-2026-23011, CVE-2026-23026, CVE-2026-23033,     CVE-2026-23037, CVE-2026-23038, CVE-2026-23049, CVE-2026-23056, CVE-2026-23058, CVE-2026-23061,     CVE-2026-23063, CVE-2026-23064, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076,     CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23087,     CVE-2026-23089, CVE-2026-23090, CVE-2026-23091, CVE-2026-23093, CVE-2026-23095, CVE-2026-23096,     CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23103, CVE-2026-23105,     CVE-2026-23108, CVE-2026-23119, CVE-2026-23120, CVE-2026-23121, CVE-2026-23124, CVE-2026-23125,     CVE-2026-23128, CVE-2026-23133, CVE-2026-23145, CVE-2026-23146, CVE-2026-23150, CVE-2026-23164,     CVE-2026-23167, CVE-2026-23170, CVE-2026-23209)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50232 advisory.

    - ipv6: use RCU in ip6_xmit() (Eric Dumazet)  [Orabug: 39202432]  {CVE-2025-40135}
    - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (Eric Dumazet)  [Orabug: 39202431]     {CVE-2026-23004}
    - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Inseo An)  [Orabug: 39044468]     {CVE-2026-23231}
    - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)     [Orabug: 39153394]  {CVE-2026-23401}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8162-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - Block layer subsystem;

    - Cryptographic API;

    - Drivers core;

    - Bluetooth drivers;

    - DMA engine subsystem;

    - GPU drivers;

    - HID subsystem;

    - Intel Trace Hub HW tracing drivers;

    - IIO ADC drivers;

    - IRQ chip drivers;

    - Modular ISDN driver;

    - LED subsystem;

    - UACCE accelerator framework;

    - Ethernet bonding driver;

    - Network drivers;

    - STMicroelectronics network drivers;

    - Ethernet team driver;

    - NVME drivers;

    - PHY drivers;

    - SLIMbus drivers;

    - W1 Dallas's 1-wire bus driver;

    - Xen hypervisor drivers;

    - BTRFS file system;

    - Ext4 file system;

    - Network file system (NFS) client;

    - Network file system (NFS) server daemon;

    - NTFS3 file system;

    - SMB network file system;

    - NFC subsystem;

    - BPF subsystem;

    - IRQ subsystem;

    - Memory management;

    - Bluetooth subsystem;

    - CAN network layer;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - L2TP protocol;

    - Netfilter;

    - NET/ROM layer;

    - Network traffic control;

    - SCTP protocol;

    - TLS protocol;

    - XFRM subsystem;

    - Creative Sound Blaster X-Fi driver;

    - USB sound devices; (CVE-2023-53421, CVE-2023-53520, CVE-2023-53662, CVE-2023-54207, CVE-2025-37849,     CVE-2025-38057, CVE-2025-38125, CVE-2025-38232, CVE-2025-38408, CVE-2025-38591, CVE-2025-40149,     CVE-2025-40164, CVE-2025-68211, CVE-2025-68340, CVE-2025-68365, CVE-2025-68725, CVE-2025-68817,     CVE-2025-71080, CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71190,     CVE-2025-71191, CVE-2025-71194, CVE-2025-71196, CVE-2025-71197, CVE-2025-71199, CVE-2026-22997,     CVE-2026-22998, CVE-2026-22999, CVE-2026-23001, CVE-2026-23003, CVE-2026-23011, CVE-2026-23026,     CVE-2026-23033, CVE-2026-23037, CVE-2026-23038, CVE-2026-23049, CVE-2026-23056, CVE-2026-23058,     CVE-2026-23060, CVE-2026-23061, CVE-2026-23063, CVE-2026-23064, CVE-2026-23071, CVE-2026-23073,     CVE-2026-23074, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083,     CVE-2026-23084, CVE-2026-23085, CVE-2026-23087, CVE-2026-23089, CVE-2026-23090, CVE-2026-23091,     CVE-2026-23093, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099,     CVE-2026-23101, CVE-2026-23103, CVE-2026-23105, CVE-2026-23108, CVE-2026-23111, CVE-2026-23119,     CVE-2026-23120, CVE-2026-23121, CVE-2026-23124, CVE-2026-23125, CVE-2026-23128, CVE-2026-23133,     CVE-2026-23145, CVE-2026-23146, CVE-2026-23150, CVE-2026-23164, CVE-2026-23167, CVE-2026-23170,     CVE-2026-23209)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50160 advisory.

    - mm/hugetlb: fix hugetlb_pmd_shared() (David Hildenbrand) [Orabug: 38931087] {CVE-2026-23100}
    - platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) [Orabug: 39044501]     {CVE-2026-23237}
    - scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) [Orabug: 39044457] {CVE-2025-71238}
    - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add (Ali Tariq) [Orabug: 38997990]     {CVE-2025-71234}
    - xfs: fix UAF in xchk_btree_check_block_owner (Darrick J. Wong) [Orabug: 38998028] {CVE-2026-23223}
    - scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) [Orabug: 38997979]     {CVE-2025-71232}
    - scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) [Orabug: 38997992]     {CVE-2025-71235}
    - scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) [Orabug: 38997998]     {CVE-2025-71236}
    - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() (Bitterblue Smith) [Orabug: 38997972]     {CVE-2025-71229}
    - crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) [Orabug: 38998052]     {CVE-2026-23229}
    - crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode (Thorsten Blum) [Orabug:
    38997976] {CVE-2025-71231}
    - smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Henrique Carvalho) [Orabug:
    38998059] {CVE-2026-23230}
    - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970593]     {CVE-2026-23202}
    - ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) [Orabug: 38970441] {CVE-2026-23190}
    - ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (Shigeru Yoshida) [Orabug: 38970598]     {CVE-2026-23200}
    - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug:
    38970170] {CVE-2026-23111}
    - net: usb: r8152: fix resume reset deadlock (Sergey Senozhatsky) [Orabug: 38970438] {CVE-2026-23188}
    - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970508]     {CVE-2026-23209}
    - net/sched: cls_u32: use skb_header_pointer_careful() (Eric Dumazet) [Orabug: 38970487] {CVE-2026-23204}
    - smb/client: fix memory leak in smb2_open_file() (Chenxiaosong) [Orabug: 38970578] {CVE-2026-23205}
    - btrfs: reject new transactions if the fs is fully read-only (Qu Wenruo) [Orabug: 38985156]     {CVE-2026-23214}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug:
    38985169] {CVE-2026-23216}
    - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug:
    38970453] {CVE-2026-23193}
    - nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (Hannes Reinecke) [Orabug: 38970416]     {CVE-2026-23179}
    - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (Perry Yuan) [Orabug: 38985149] {CVE-2026-23213}
    - HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (Kwok Kin Ming) [Orabug: 38970413]     {CVE-2026-23178}
    - md: suspend array while updating raid_disks via sysfs (Danny Shih) [Orabug: 38985108] {CVE-2025-71225}
    - wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) [Orabug: 38970152] {CVE-2025-71222}
    - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) [Orabug: 38970163]     {CVE-2025-71224}
    - procfs: avoid fetching build ID while holding VMA lock (Andrii Nakryiko) [Orabug: 38970476]     {CVE-2026-23199}
    - mm, shmem: prevent infinite loop on truncate race (Kairui Song) [Orabug: 38970409] {CVE-2026-23177}
    - ceph: fix oops due to invalid pointer for kfree() in parse_longname() (Daniel Vogelbacher) [Orabug:
    38970590] {CVE-2026-23201}
    - ceph: fix NULL pointer dereference in ceph_mds_auth_match() (Viacheslav Dubeyko) [Orabug: 38970595]     {CVE-2026-23189}
    - mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (Hao Ge) [Orabug: 38985192]     {CVE-2026-23219}
    - ALSA: aloop: Fix racy access at PCM trigger (Takashi Iwai) [Orabug: 38970445] {CVE-2026-23191}
    - x86/vmware: Fix hypercall clobbers (Josh Poimboeuf) [Orabug: 38985163] {CVE-2026-23215}
    - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (Yunje Shin) [Orabug: 38970176]     {CVE-2026-23112}
    - perf: sched: Fix perf crash with new is_user_task() helper (Steven Rostedt) [Orabug: 38970581]     {CVE-2026-23159}
    - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode (Kang Yang) [Orabug: 37844126]     {CVE-2024-58096}
    - drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (Jon Doron) [Orabug:
    38970348] {CVE-2026-23163}
    - net: fix segmentation of forwarding fraglist GRO (Jibin Zhang) [Orabug: 38970318] {CVE-2026-23154}
    - mm/shmem, swap: fix race of truncate and swap entry split (Kairui Song) [Orabug: 38970345]     {CVE-2026-23161}
    - flex_proportions: make fprop_new_period() hardirq safe (Jan Kara) [Orabug: 38970373] {CVE-2026-23168}
    - nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (Ming Lei) [Orabug: 38970608]     {CVE-2026-23148}
    - efivarfs: fix error propagation in efivar_entry_get() (Kohei Enju) [Orabug: 38970325] {CVE-2026-23156}
    - net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970397] {CVE-2026-23173}
    - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Aaron Ma) [Orabug: 38970364]     {CVE-2026-23166}
    - rocker: fix memory leak in rocker_world_port_post_fini() (Kery Qi) [Orabug: 38970351] {CVE-2026-23164}
    - bonding: annotate data-races around slave->last_rx (Eric Dumazet) [Orabug: 38985142] {CVE-2026-23212}
    - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (Jianpeng Chang) [Orabug: 38970587]     {CVE-2026-23151}
    - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (Jia-Hong Su) [Orabug: 38970604]     {CVE-2026-23146}
    - wifi: ath11k: fix RCU stall while reaping monitor destination ring (P Praneesh) [Orabug: 37844129]     {CVE-2024-58097}
    - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) [Orabug: 38798802]     {CVE-2025-68358}
    - sched_ext: Fix possible deadlock in the deferred_irq_workfn() (Zqiang) [Orabug: 38792605]     {CVE-2025-68333}
    - exfat: fix refcount leak in exfat_find (Shuhao Fu) [Orabug: 38798780] {CVE-2025-68351}
    - bpf: Do not let BPF test infra emit invalid GSO types to stack (Daniel Borkmann) [Orabug: 38798881]     {CVE-2025-68725}
    - migrate: correct lock ordering for hugetlb file folios (Matthew Wilcox) [Orabug: 38931066]     {CVE-2026-23097}
    - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38931120]     {CVE-2026-23108}
    - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug:
    38930881] {CVE-2026-23061}
    - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde) [Orabug: 38930859]     {CVE-2026-23058}
    - irqchip/gic-v3-its: Avoid truncating memory addresses (Arnd Bergmann) [Orabug: 38931001]     {CVE-2026-23085}
    - intel_th: fix device leak on output open() (Johan Hovold) [Orabug: 38931040] {CVE-2026-23091}
    - tracing: Fix crash on synthetic stacktrace field usage (Steven Rostedt) [Orabug: 38931024]     {CVE-2026-23088}
    - arm64: Set __nocfi on swsusp_arch_resume() (Zhaoyang Huang) [Orabug: 38970241] {CVE-2026-23128}
    - arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (Mark Rutland) [Orabug: 38931118]     {CVE-2026-23107}
    - wifi: rsi: Fix memory corruption due to not set vif driver data size (Marek Vasut) [Orabug: 38930939]     {CVE-2026-23073}
    - wifi: ath10k: fix dma_free_coherent() pointer (Thomas Fourier) [Orabug: 38970253] {CVE-2026-23133}
    - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (Berk Cem Goksel) [Orabug: 38931029]     {CVE-2026-23089}
    - ALSA: scarlett2: Fix buffer overflow in config retrieval (Samasth Norway Ananda) [Orabug: 38930973]     {CVE-2026-23078}
    - ALSA: ctxfi: Fix potential OOB access in audio mixer handling (Takashi Iwai) [Orabug: 38930966]     {CVE-2026-23076}
    - leds: led-class: Only Add LED to leds_list when it is fully ready (Hans de Goede) [Orabug: 38931091]     {CVE-2026-23101}
    - dpll: Prevent duplicate registrations (Ivan Vecera) [Orabug: 38970244] {CVE-2026-23129}
    - vsock/virtio: cap TX credit to local buffer size (Melbin K Mathew) [Orabug: 38931008] {CVE-2026-23086}
    - vsock/virtio: fix potential underflow in virtio_transport_get_credit() (Melbin K Mathew) [Orabug:
    38930919] {CVE-2026-23069}
    - bonding: provide a net pointer to __skb_flow_dissect() (Eric Dumazet) [Orabug: 38970199]     {CVE-2026-23119}
    - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (Andrey Vatoropin) [Orabug: 38930992]     {CVE-2026-23084}
    - ipv6: annotate data-race in ndisc_router_discovery() (Eric Dumazet) [Orabug: 38970222] {CVE-2026-23124}
    - netdevsim: fix a race issue related to the operation on bpf_bound_progs list (Yun Lu) [Orabug: 38970233]     {CVE-2026-23126}
    - scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930867]     {CVE-2026-23059}
    - scsi: core: Wake up the error handler when final completions race against each other (David Jeffery)     [Orabug: 38931132] {CVE-2026-23110}
    - regmap: Fix race condition in hwspinlock irqsave routine (Cheng-Yu Lee) [Orabug: 38930930]     {CVE-2026-23071}
    - interconnect: debugfs: initialize src_node and dst_node to empty strings (Georgi Djakov) [Orabug:
    38970218] {CVE-2026-23123}
    - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (Jens Axboe) [Orabug: 38970181]     {CVE-2026-23113}
    - platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (Mario Limonciello) [Orabug:
    38930890] {CVE-2026-23062}
    - platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (Mario Limonciello) [Orabug:
    38970247] {CVE-2026-23131}
    - scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (Abdun Nihaal) [Orabug: 38931014]     {CVE-2026-23087}
    - w1: therm: Fix off-by-one buffer overflow in alarms_store (Thorsten Blum) [Orabug: 38930796]     {CVE-2025-71197}
    - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Taeyang Lee) [Orabug:
    38930874] {CVE-2026-23060}
    - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (Jamal Hadi     Salim) [Orabug: 38931110] {CVE-2026-23105}
    - net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930948]     {CVE-2026-23074}
    - ipvlan: Make the addrs_lock be per port (Dmitry Skorodumov) [Orabug: 38931102] {CVE-2026-23103}
    - l2tp: avoid one data-race in l2tp_tunnel_del_work() (Eric Dumazet) [Orabug: 38970202] {CVE-2026-23120}
    - gue: Fix skb memleak with inner IP protocol 0. (Kuniyuki Iwashima) [Orabug: 38931057] {CVE-2026-23095}
    - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [Orabug: 38970225]     {CVE-2026-23125}
    - can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (Marc Kleine-Budde)     [Orabug: 38931184] {CVE-2026-23082}
    - l2tp: Fix memleak in l2tp_udp_encap_recv(). (Kuniyuki Iwashima) [Orabug: 38930935] {CVE-2026-23072}
    - bonding: limit BOND_MODE_8023AD to Ethernet devices (Eric Dumazet) [Orabug: 38931079] {CVE-2026-23099}
    - vsock/virtio: Coalesce only linear skb (Michal Luczaj) [Orabug: 38930857] {CVE-2026-23057}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1468 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() (CVE-2023-53421)

    In the Linux kernel, the following vulnerability has been resolved:

    iomap: Fix possible overflow condition in iomap_write_delalloc_scan (CVE-2023-54285)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Reject narrower access to pointer ctx fields (CVE-2025-38591)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix potential UAF in smb2_close_cached_fid() (CVE-2025-40328)

    In the Linux kernel, the following vulnerability has been resolved:

    team: Move team device type change at the end of team_port_add (CVE-2025-68340)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Initialize allocated memory before use (CVE-2025-68365)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Do not let BPF test infra emit invalid GSO types to stack (CVE-2025-68725)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (CVE-2025-71194)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix reservation leak in some error paths when inserting inline extent (CVE-2025-71268)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_qfq: do not free existing class in qfq_change_class() (CVE-2026-22999)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (CVE-2026-23005)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix use-after-free in inet6_addr_del(). (CVE-2026-23010)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: ip_gre: make ipgre_header() robust (CVE-2026-23011)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/page_alloc: prevent pcp corruption with SMP=n (CVE-2026-23025)

    In the Linux kernel, the following vulnerability has been resolved:

    pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (CVE-2026-23038)

    In the Linux kernel, the following vulnerability has been resolved:

    net: hv_netvsc: reject RSS hash key programming without RX indirection table (CVE-2026-23054)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (CVE-2026-23060)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock/virtio: fix potential underflow in virtio_transport_get_credit() (CVE-2026-23069)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: Fix race condition in hwspinlock irqsave routine (CVE-2026-23071)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Enforce that teql can only be used as root qdisc (CVE-2026-23074)

    In the Linux kernel, the following vulnerability has been resolved:

    fou: Don't allow 0 for FOU_ATTR_IPPROTO. (CVE-2026-23083)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3-its: Avoid truncating memory addresses (CVE-2026-23085)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock/virtio: cap TX credit to local buffer size (CVE-2026-23086)

    In the Linux kernel, the following vulnerability has been resolved:

    gue: Fix skb memleak with inner IP protocol 0. (CVE-2026-23095)

    In the Linux kernel, the following vulnerability has been resolved:

    migrate: correct lock ordering for hugetlb file folios (CVE-2026-23097)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: limit BOND_MODE_8023AD to Ethernet devices (CVE-2026-23099)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/fpsimd: signal: Fix restoration of SVE context (CVE-2026-23102)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvlan: Make the addrs_lock be per port (CVE-2026-23103)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CVE-2026-23105)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (CVE-2026-23107)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CVE-2026-23111)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: provide a net pointer to __skb_flow_dissect() (CVE-2026-23119)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: annotate data-race in ndisc_router_discovery() (CVE-2026-23124)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (CVE-2026-23125)

    In the Linux kernel, the following vulnerability has been resolved:

    netdevsim: fix a race issue related to the operation on bpf_bound_progs list (CVE-2026-23126)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: Set __nocfi on swsusp_arch_resume() (CVE-2026-23128)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (CVE-2026-23142)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (CVE-2026-23144)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (CVE-2026-23145)

    In the Linux kernel, the following vulnerability has been resolved:

    efivarfs: fix error propagation in efivar_entry_get() (CVE-2026-23156)

    In the Linux kernel, the following vulnerability has been resolved:

    flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Don't clobber irqfd routing type when deassigning irqfd (CVE-2026-23198)

    In the Linux kernel, the following vulnerability has been resolved:

    smb/client: fix memory leak in smb2_open_file() (CVE-2026-23205)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: annotate data-races around slave->last_rx (CVE-2026-23212)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1455 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Reject narrower access to pointer ctx fields (CVE-2025-38591)

    In the Linux kernel, the following vulnerability has been resolved:

    sched_ext: Fix possible deadlock in the deferred_irq_workfn() (CVE-2025-68333)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: fix refcount leak in exfat_find (CVE-2025-68351)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (CVE-2025-68358)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Initialize allocated memory before use (CVE-2025-68365)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Do not let BPF test infra emit invalid GSO types to stack (CVE-2025-68725)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (CVE-2025-71194)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (CVE-2026-22996)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_qfq: do not free existing class in qfq_change_class() (CVE-2026-22999)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix crash on profile change rollback failure (CVE-2026-23000)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001)

    In the Linux kernel, the following vulnerability has been resolved:

    lib/buildid: use __kernel_read() for sleepable context (CVE-2026-23002)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (CVE-2026-23005)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix use-after-free in inet6_addr_del(). (CVE-2026-23010)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: ip_gre: make ipgre_header() robust (CVE-2026-23011)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/page_alloc: prevent pcp corruption with SMP=n (CVE-2026-23025)

    In the Linux kernel, the following vulnerability has been resolved:

    null_blk: fix kmemleak by releasing references to fault configfs items (CVE-2026-23032)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (CVE-2026-23035)

    In the Linux kernel, the following vulnerability has been resolved:

    pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (CVE-2026-23038)

    In the Linux kernel, the following vulnerability has been resolved:

    pNFS: Fix a deadlock when returning a delegation during open() (CVE-2026-23050)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix a deadlock involving nfs_release_folio() (CVE-2026-23053)

    In the Linux kernel, the following vulnerability has been resolved:

    net: hv_netvsc: reject RSS hash key programming without RX indirection table (CVE-2026-23054)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock/virtio: Coalesce only linear skb (CVE-2026-23057)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (CVE-2026-23060)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock/virtio: fix potential underflow in virtio_transport_get_credit() (CVE-2026-23069)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: Fix race condition in hwspinlock irqsave routine (CVE-2026-23071)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Enforce that teql can only be used as root qdisc (CVE-2026-23074)

    In the Linux kernel, the following vulnerability has been resolved:

    fou: Don't allow 0 for FOU_ATTR_IPPROTO. (CVE-2026-23083)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3-its: Avoid truncating memory addresses (CVE-2026-23085)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock/virtio: cap TX credit to local buffer size (CVE-2026-23086)

    In the Linux kernel, the following vulnerability has been resolved:

    gue: Fix skb memleak with inner IP protocol 0. (CVE-2026-23095)

    In the Linux kernel, the following vulnerability has been resolved:

    migrate: correct lock ordering for hugetlb file folios (CVE-2026-23097)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: limit BOND_MODE_8023AD to Ethernet devices (CVE-2026-23099)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvlan: Make the addrs_lock be per port (CVE-2026-23103)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CVE-2026-23105)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (CVE-2026-23107)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (CVE-2026-23113)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: provide a net pointer to __skb_flow_dissect() (CVE-2026-23119)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: annotate data-race in ndisc_router_discovery() (CVE-2026-23124)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (CVE-2026-23125)

    In the Linux kernel, the following vulnerability has been resolved:

    netdevsim: fix a race issue related to the operation on bpf_bound_progs list (CVE-2026-23126)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: Set __nocfi on swsusp_arch_resume() (CVE-2026-23128)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: send: check for inline extents in range_is_hole_in_parent() (CVE-2026-23141)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (CVE-2026-23142)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (CVE-2026-23144)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (CVE-2026-23145)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.201-140.219. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2026-098 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED (CVE-2022-50390)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() (CVE-2023-53421)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} (CVE-2023-53662)

    In the Linux kernel, the following vulnerability has been resolved:

    page_pool: Fix use-after-free in page_pool_recycle_in_ring (CVE-2025-38129)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Reject narrower access to pointer ctx fields (CVE-2025-38591)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: delete x->tunnel as we delete x (CVE-2025-40215)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (CVE-2025-68261)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: refresh inline data size before write operations (CVE-2025-68264)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CVE-2025-68325)

    In the Linux kernel, the following vulnerability has been resolved:

    jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (CVE-2025-68337)

    In the Linux kernel, the following vulnerability has been resolved:

    team: Move team device type change at the end of team_port_add (CVE-2025-68340)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (CVE-2025-68358)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Initialize allocated memory before use (CVE-2025-68365)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: defer config put in recv_work (CVE-2025-68372)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Do not let BPF test infra emit invalid GSO types to stack (CVE-2025-68725)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs3: Fix uninit buffer allocated by __getname() (CVE-2025-68727)

    In the Linux kernel, the following vulnerability has been resolved:

    ntfs3: fix uninit memory after failed mi_read in mi_format_new (CVE-2025-68728)

    In the Linux kernel, the following vulnerability has been resolved:

    ima: Handle error code returned by ima_filter_rule_match() (CVE-2025-68740)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (CVE-2025-68764)

    In the Linux kernel, the following vulnerability has been resolved:

    sched/deadline: only set free_cpus for online runqueues (CVE-2025-68780)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: target: Reset t_task_cdb pointer in error case (CVE-2025-68782)

    In the Linux kernel, the following vulnerability has been resolved:

    net: openvswitch: fix middle attribute validation in push_nsh() action (CVE-2025-68785)

    In the Linux kernel, the following vulnerability has been resolved:

    fsnotify: do not generate ACCESS/MODIFY events on child for special files (CVE-2025-68788)

    In the Linux kernel, the following vulnerability has been resolved:

    ethtool: Avoid overflowing userspace buffer on stats query (CVE-2025-68795)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: NFSv4 file creation neglects setting ACL (CVE-2025-68803)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvs: fix ipv4 null-ptr-deref in route error path (CVE-2025-68813)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring: fix filename leak in __io_openat_prep() (CVE-2025-68814)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: fw_tracer, Validate format string parameters (CVE-2025-68816)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: xattr: fix null pointer deref in ext4_raw_inode() (CVE-2025-68820)

    In the Linux kernel, the following vulnerability has been resolved:

    fuse: fix readahead reclaim deadlock (CVE-2025-68821)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: Cap the number of PCR banks (CVE-2025-71077)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/ttm: Avoid NULL pointer deref for evicted BOs (CVE-2025-71083)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/cm: Fix leaking the multicast GID table reference (CVE-2025-71084)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CVE-2025-71085)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)

    In the Linux kernel, the following vulnerability has been resolved:

    team: fix check for port enabled in team_queue_override_port_prio_changed() (CVE-2025-71091)

    In the Linux kernel, the following vulnerability has been resolved:

    e1000: fix OOB in e1000_tbi_should_accept() (CVE-2025-71093)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly (CVE-2025-71096)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: Fix reference count leak when using error routes with nexthop objects (CVE-2025-71097)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_gre: make ip6gre_header() robust (CVE-2025-71098)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (CVE-2025-71104)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Avoid walking the Namespace if start_node is NULL (CVE-2025-71118)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (CVE-2025-71120)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Do not register unsupported perf events (CVE-2025-71125)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: seqiv - Do not use req->iv after crypto_aead_encrypt (CVE-2025-71131)

    In the Linux kernel, the following vulnerability has been resolved:

    KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CVE-2025-71147)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (CVE-2025-71194)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (CVE-2026-22976)

    In the Linux kernel, the following vulnerability has been resolved:

    net: sock: fix hardened usercopy panic in sock_recv_errqueue (CVE-2026-22977)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: provide locking for v4_end_grace (CVE-2026-22980)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: make free_choose_arg_map() resilient to partial allocation (CVE-2026-22991)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: return the handler error from mon_handle_auth_done() (CVE-2026-22992)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_qfq: do not free existing class in qfq_change_class() (CVE-2026-22999)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: ip_gre: make ipgre_header() robust (CVE-2026-23011)

    In the Linux kernel, the following vulnerability has been resolved:

    pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (CVE-2026-23038)

    In the Linux kernel, the following vulnerability has been resolved:

    libceph: make calc_target() set t->paused, not just clear it (CVE-2026-23047)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (CVE-2026-23060)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: Fix race condition in hwspinlock irqsave routine (CVE-2026-23071)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Enforce that teql can only be used as root qdisc (CVE-2026-23074)

    In the Linux kernel, the following vulnerability has been resolved:

    fou: Don't allow 0 for FOU_ATTR_IPPROTO. (CVE-2026-23083)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3-its: Avoid truncating memory addresses (CVE-2026-23085)

    In the Linux kernel, the following vulnerability has been resolved:

    gue: Fix skb memleak with inner IP protocol 0. (CVE-2026-23095)

    In the Linux kernel, the following vulnerability has been resolved:

    migrate: correct lock ordering for hugetlb file folios (CVE-2026-23097)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: limit BOND_MODE_8023AD to Ethernet devices (CVE-2026-23099)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvlan: Make the addrs_lock be per port (CVE-2026-23103)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CVE-2026-23105)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CVE-2026-23111)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: provide a net pointer to __skb_flow_dissect() (CVE-2026-23119)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: annotate data-race in ndisc_router_discovery() (CVE-2026-23124)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (CVE-2026-23125)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (CVE-2026-23145)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (CVE-2026-23169)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Don't clobber irqfd routing type when deassigning irqfd (CVE-2026-23198)

    In the Linux kernel, the following vulnerability has been resolved:

    macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209)

    In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: fix use-after-free in     driver_override_show() The driver_override_show() function reads the driver_override string without     holding the device_lock. However, driver_override_store() uses driver_set_override(), which modifies and     frees the string while holding the device_lock. This can result in a concurrent use-after-free if the     string is freed by the store function while being read by the show function. Fix this by holding the     device_lock around the read operation. (CVE-2026-23221)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ipv6: annotate data-race in ndisc_router_discovery() syzbot found that ndisc_router_discovery() could read     and write in6_dev->ra_mtu without holding a lock [1] This looks fine, IFLA_INET6_RA_MTU is best effort.
    Add READ_ONCE()/WRITE_ONCE() to document the race. Note that we might also reject illegal MTU values (mtu     < IPV6_MIN_MTU || mtu > skb->dev->mtu) in a future patch. [1] BUG: KCSAN: data-race in     ndisc_router_discovery / ndisc_router_discovery read to 0xffff888119809c20 of 4 bytes by task 25817 on cpu     1: ndisc_router_discovery+0x151d/0x1c90 net/ipv6/ndisc.c:1558 ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841     icmpv6_rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989 ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438     ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline]     ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500 ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590 dst_input     include/net/dst.h:474 [inline] ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79 ... write to     0xffff888119809c20 of 4 bytes by task 25816 on cpu 0: ndisc_router_discovery+0x155a/0x1c90     net/ipv6/ndisc.c:1559 ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841 icmpv6_rcv+0xe5a/0x12f0     net/ipv6/icmp.c:989 ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438     ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline]     ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500 ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590 dst_input     include/net/dst.h:474 [inline] ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79 ... value changed:
    0x00000000 -> 0xe5400659 (CVE-2026-23124)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
307553	Ubuntu Pro Realtime 22.04 LTS : Linux kernel (Real-time) vulnerabilities (USN-8186-1)	Nessus	Ubuntu Local Security Checks	high
307552	Ubuntu 22.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8187-1)	Nessus	Ubuntu Local Security Checks	high
307548	Ubuntu 20.04 LTS : Linux kernel (HWE) vulnerabilities (USN-8188-1)	Nessus	Ubuntu Local Security Checks	high
307006	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-8180-1)	Nessus	Ubuntu Local Security Checks	high
306779	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50232)	Nessus	Oracle Linux Local Security Checks	critical
306092	Ubuntu 20.04 LTS : Linux kernel (NVIDIA Tegra) vulnerabilities (USN-8162-1)	Nessus	Ubuntu Local Security Checks	high
303468	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50160)	Nessus	Oracle Linux Local Security Checks	critical
301901	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50145)	Nessus	Oracle Linux Local Security Checks	high
301346	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-1468)	Nessus	Amazon Linux Local Security Checks	high
301337	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1455)	Nessus	Amazon Linux Local Security Checks	high
301269	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2026-098 (ALASKERNEL-5.15-2026-098)	Nessus	Amazon Linux Local Security Checks	high
299743	Photon OS 5.0: Linux PHSA-2026-5.0-0770	Nessus	PhotonOS Local Security Checks	critical
299168	Linux Distros Unpatched Vulnerability : CVE-2026-23124	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-23124

medium

Tenable Plugins

high

high

high

high

critical

high

critical

high

high

high

high

critical

medium